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Subject: Proposal for a Regulation of the European Parliament and of the Council 
laying down rules to prevent and combat child sexual abuse 


— Presidency compromise texts 


With a view to the Law Enforcement Working Party (Police) meeting on 27 and 28 April 2023, 


delegations will find in the Annex Presidency compromise texts on the above proposal. 
Changes to the Commission proposal are marked in bold and strikethrough. 


New changes to the Commission proposal in comparison to documents 7595/23 are marked in bold 


underline and strikethrouch-undertne. 
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ANNEX 


Proposal for a 
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 


laying down rules to prevent and combat child sexual abuse 


(Text with EEA relevance) 
CHAPTERI 
GENERAL PROVISIONS 
Article 1 


Subject matter and scope 


1. This Regulation lays down uniform rules to prevent and address the misuse of relevant 
information society services for online child sexual abuse in the internal market. 


It establishes, in particular: 


(a) obligations on providers of relevant information society services to minimise the risk 
that their services are misused for online child sexual abuse; 


(b) obligations on providers of hosting services and providers of interpersonal 
communication services to detect and report online child sexual abuse; 


(c) obligations on providers of hosting services to remove or disable access to child 
sexual abuse material on their services; 


(d) obligations on providers of internet access services to prevent users from accessing 
aeeess child sexual abuse material; 


(da) obligations on providers of online search engines to delist websites indicating 
specific items of child sexual abuse; 


(e) rules on the implementation and enforcement of this Regulation, including as regards 
the designation and functioning of the competent authorities of the Member States, 
the EU Centre on Child Sexual Abuse established in Article 40 (‘EU Centre’) and 
cooperation and transparency. 
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3a. 


This Regulation shall apply to providers of relevant information society services offering 
such services in the Union, irrespective of their place of main establishment. 


This Regulation shall not affect the rules laid down by the following legal acts: 


(a) Directive 2011/93/EU on combating the sexual abuse and sexual exploitation of 
children and child pornography, and replacing Council Framework Decision 
2004/68/JHA; 


(b) Directive 2000/31/EC and Regulation (EU) .../... [on a Single Market For Digital 
Services (Digital Services Act) and amending Directive 2000/3 1/EC]; 


(ba) Regulation (EU) 2022/... of ... on contestable and fair markets in the digital 
sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital 
Markets Act); 


(c) Directive 2010/13/EU; 


(d) Regulation (EU) 2016/679, Directive 2016/680, Regulation (EU) 2018/1725, and, 
subject to paragraph 4 of this Article, Directive 2002/58/EC; 


(e) Regulation (EU) 2021/784 of the European Parliament and of the Council of 29 
April 2021 on addressing the dissemination of terrorist content online. 


This Regulation shall not have the effect of modifying the obligation to respect the 
rights, freedoms and principles referred to in Article 6 TEU and shall apply without 
prejudice to fundamental principles relating to the right for respect to private life and 
family life and to freedom of expression and information.' 


This Regulation limits the exercise of the rights and obligations provided for in 5(1) and 
(3) and Article 6(1) of Directive 2002/58/EC insofar as necessary for the execution of the 
detection orders issued in accordance with Section 2 of Chapter + II of this Regulation. 


Wording copied from Art. 1(4) of TCO Regulation with an additional reference to the right to 


private life. 
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Article 2 


Definitions 


For the purpose of this Regulation, the following definitions apply: 


(a) 


(b) 


(c) 


(d) 


(c) 


(f) 


‘hosting service’ means an information society service as defined in Article 2, point (f), 
third indent, of Regulation (EU) .../... fon a Single Market For Digital Services (Digital 
Services Act) and amending Directive 2000/3 1/EC]; 

‘number-independent interpersonal communications service’ means a publicly available 
service as defined in Article 2, point 7 3, of Directive (EU) 2018/1972, including services 
which enable direct interpersonal and interactive exchange of information merely as a 
minor ancillary feature that is intrinsically linked to another service; ? 

‘software application’ means a digital product or service as defined in Article 2, point 13, 
of Regulation (EU) .../... [on contestable and fair markets in the digital sector (Digital 
Markets Act)]; 


‘software application store’ means a service as defined in Article 2, point 12, of Regulation 
(EU) .../... [on contestable and fair markets in the digital sector (Digital Markets Act)] ; 


‘internet access service’ means a service as defined in Article 2(2), point 2, of Regulation 
(EU) 2015/2120 of the European Parliament and of the Council’; 


‘relevant information society services’ means all of the following services: 
(i) a hosting service; 

(11) an interpersonal communications service; 

(111) asoftware applications store; 

(iv) an internet access service; 


(v) online search engines. 


PCY comment: See Article 2(1) of the Temporary Regulation (EU) 2021/1232. Many 
opinions have been expressed that the scope should not include regular telecom providers but 
be limited to the number-independent service providers. The draft opinion of the IMCO 
Committee in the EP is also going in this direction and provides elaborate additions to recital 
By 

Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November 
2015 laying down measures concerning open internet access and amending Directive 
2002/22/EC on universal service and users’ rights relating to electronic communications 
networks and services and Regulation (EU) No 531/2012 on roaming on public mobile 
communications networks within the Union (OJ L 310, 26.11.2015, p. 1-18). 
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(g) ‘to offer services in the Union’ means to offer services in the Union as defined in Article 2, 
point (d), of Regulation (EU) .../... [on a Single Market For Digital Services (Digital 
Services Act) and amending Directive 2000/3 1/EC]; 


(h) ‘user’ means any natural or legal person who uses a relevant information society service; 
(i) ‘child’ means any natural person below the age of 18 years;4 


“ b > 


who-is-a natural person below the age of 17 years:> 


(k) ‘micro, small or medium-sized enterprise’ means an enterprise as defined in Commission 
Recommendation 2003/361 concerning the definition of micro, small and medium-sized 
enterprises®; 


(1) ‘child sexual abuse material’ means: material constituting child pornography or 
pornographic performance as defined in Article 2, points (c) and (e), respectively, of 
Directive 201 1/93/EU; 


(m) ‘known child sexual abuse material’ means potential child sexual abuse material detected 
using the indicators contained in the database of indicators referred to in Article 44(1), 
point (a); 


(n) ‘new child sexual abuse material’ means potential child sexual abuse material detected 
using the indicators contained in the database of indicators referred to in Article 44(1), 
point (b); 


(0) ‘solicitation of children’ means the solicitation of children for sexual purposes as referred 
to in Article 6 of Directive 2011/93/EU; 


(p) ‘online child sexual abuse’ means the online dissemination of child sexual abuse material 
and the solicitation of children; 


PCY comment: The term child appears 511 times in the whole proposal including in the 
explanatory statements. The PCY is of the view that the term child can be used where it does 
not lead to problematic incompatibilities between the exercise of powers by Member States, 
for instance when it comes to the notice mechanism being developed under Article 12. 

PCY comment: It seems superfluous to define child user since child is already defined in 
point (1) (in document 14143/22 the age was set at 18). Furthermore, the term child user 
appears in Articles 3(2)(e)(i1) and (111), 4(3), 6(1)(b) and (c) and 7(7), i.e on six occasions. As 
those Articles and paragraphs are discussed, alternative wording should be developed. 
Commission Recommendation of 6 May 2003 concerning the definition of micro, small and 
medium-sized enterprises (OJ L 124, 20.5.2003, p. 36-41). 
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(q) 


(r) 


(s) 


(t) 


(u) 


(v) 


(w) 


(x) 


‘child sexual abuse offences’ means offences as defined in Articles 3 to 7 of Directive 
2011/93/EU; 


‘recommender system’ means the system as defined in Article 2, point (0), of Regulation 
(EU) .../... fon a Single Market For Digital Services (Digital Services Act) and amending 
Directive 2000/31/EC]; 


‘content data’ means data as defined in Article 2, point 10, of Regulation (EU) ... [on 
European Production and Preservation Orders for electronic evidence in criminal matters 
(.../... e-evidence Regulation) ]; 


‘content moderation’ means the activities as defined in Article 2, point (p), of Regulation 
(EU) .../... fon a Single Market For Digital Services (Digital Services Act) and amending 
Directive 2000/31/EC]; 


‘Coordinating Authority of establishment’ means the Coordinating Authority for child 
sexual abuse issues designated in accordance with Article 25 by the Member State where 
the provider of information society services has its main establishment or, where 
applicable, where its legal representative resides or is established; 


‘terms and conditions’ means terms and conditions as defined in Article 2, point (q), of 
Regulation (EU) .../... fon a Single Market For Digital Services (Digital Services Act) and 
amending Directive 2000/31/EC] ; 


‘main establishment’ means the head office or registered office of the provider of relevant 
information society services within which the principal financial functions and operational 
control are exercised; 


‘online search engine’ means an intermediary service as defined in Article 3, point (j), 
of Regulation (EU) .../... [on a Single Market For Digital Services (Digital Services 
Act) and amending Directive 2000/31/EC]. 
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CHAPTERII 
OBLIGATIONS OF PROVIDERS OF RELEVANT INFORMATION SOCIETY SERVICES 
TO PREVENT AND COMBAT ONLINE CHILD SEXUAL ABUSE 


Section 1 
Risk assessment and mitigation obligations 


Article 3 
Risk assessment 
Leaf 
[No new compromise texts in this Article] 
Article 4 


Risk mitigation 


Lend 
[No new compromise texts in this Article] 
Article 5 
Risk reporting 
[...] 
[No new compromise texts in this Article] 
Article 6 


Obligations for software application stores 


ea 


[No new compromise texts in this Article] 
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Section 2 
Detection obligations 


Article 7 
Issuance of detection orders 


1. The Coordinating Authority of establishment shall have the power to request the competent 
judicial authority of the Member State that designated it or another independent 
administrative authority of that Member State to issue a detection order requiring a 
provider of hosting services or a provider of interpersonal communications services under 
the jurisdiction of that Member State to take the measures specified in Article 10 to detect 
online child sexual abuse on a specific service. 


2 The Coordinating Authority of establishment shall, before requesting the issuance of a 
detection order, carry out the investigations and assessments necessary to determine 
whether the conditions of paragraph 4 have been met. 


To that end, it may, where appropriate, require the provider to submit the necessary 
information, additional to the report and the further information referred to in Article 5(1) 
and (3), respectively, within a reasonable time period set by that Coordinating Authority, 
or request the EU Centre, another public authority or relevant experts or entities to provide 
the necessary additional information. 


33 Where the Coordinating Authority of establishment takes the preliminary view that the 
conditions of paragraph 4 have been met, it shall: 


(a) establish a draft request for the issuance of a detection order, specifying the main 
elements of the content of the detection order it intends to request and the reasons for 
requesting it; 


(b) submit the draft request to the provider and the EU Centre; 


(c) afford the provider an opportunity to comment on the draft request, within a 
reasonable time period set by that Coordinating Authority; 


(d) invite the EU Centre to provide its opinion on the draft request, within a time period 
of four weeks from the date of receiving the draft request. 


Where, having regard to the comments of the provider and the opinion of the EU Centre, 
that Coordinating Authority continues to be of the view that the conditions of paragraph 4 
have met, it shall re-submit the draft request, adjusted where appropriate, to the provider. 
In that case, the provider shall do all of the following, within a reasonable time period set 
by that Coordinating Authority: 
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(a) draft an implementation plan setting out the measures it envisages taking to execute 
the intended detection order, including detailed information regarding the envisaged 
technologies and safeguards; 


(b) where the draft implementation plan concerns an intended detection order concerning 
the solicitation of children other than the renewal of a previously issued detection 
order without any substantive changes, conduct a data protection impact assessment 
and a prior consultation procedure as referred to in Articles 35 and 36 of Regulation 
(EU) 2016/679, respectively, in relation to the measures set out in_ the 
implementation plan; 


(c) where point (b) applies, or where the conditions of Articles 35 and 36 of Regulation 
(EU) 2016/679 are met, adjust the draft implementation plan, where necessary in 
view of the outcome of the data protection impact assessment and in order to take 
into account the opinion of the data protection authority provided in response to the 
prior consultation; 


(d) submit to that Coordinating Authority the implementation plan, where applicable 
attaching the opinion of the competent data protection authority and specifying how 
the implementation plan has been adjusted in view of the outcome of the data 
protection impact assessment and of that opinion. 


Where, having regard to the implementation plan of the provider and the opinion of the 
data protection authority, that Coordinating Authority continues to be of the view that the 
conditions of paragraph 4 have met, it shall submit the request for the issuance of the 
detection, adjusted where appropriate, to the competent judicial authority or independent 
administrative authority. It shall attach the implementation plan of the provider and the 
opinions of the EU Centre and the data protection authority to that request. 


4. The Coordinating Authority of establishment shall request the issuance of the detection 
order, and the competent judicial authority or independent administrative authority shall 
issue the detection order where it considers that the following conditions are met: 


(a) there is evidence of a significant risk of the service being used for the purpose of 
online child sexual abuse, within the meaning of paragraphs 5, 6 and 7, as applicable; 


(b) the reasons for issuing the detection order outweigh negative consequences for the 
rights and legitimate interests of all parties affected, having regard in particular to the 
need to ensure a fair balance between the fundamental rights of those parties. 


When assessing whether the conditions of the first subparagraph have been met, account 
shall be taken of all relevant facts and circumstances of the case at hand, in particular: 


(a) the risk assessment conducted or updated and any mitigation measures taken by the 
provider pursuant to Articles 3 and 4, including any mitigation measures introduced, 
reviewed, discontinued or expanded pursuant to Article 5(4) where applicable; 
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(b) any additional information obtained pursuant to paragraph 2 or any other relevant 
information available to it, in particular regarding the use, design and operation of 
the service, regarding the provider’s financial and technological capabilities and size 
and regarding the potential consequences of the measures to be taken to execute the 
detection order for all other parties affected; 


(c) the views and the implementation plan of the provider submitted in accordance with 
paragraph 3; 


(d) the opinions of the EU Centre and of the data protection authority submitted in 
accordance with paragraph 3. 


As regards the second subparagraph, point (d), where that Coordinating Authority 
substantially deviates from the opinion of the EU Centre, it shall inform the EU Centre and 
the Commission thereof, specifying the points at which it deviated and the main reasons 
for the deviation. 


a As regards detection orders concerning the dissemination of known child sexual abuse 
material, the significant risk referred to in paragraph 4, first subparagraph, point (a), shall 
be deemed to exist where the following conditions are met: 


(a) itis likely, despite any mitigation measures that the provider may have taken or will 
take, that the service is used, to an appreciable extent for the dissemination of known 
child sexual abuse material; 


(b) there is evidence of the service, or of a comparable service if the service has not yet 
been offered in the Union at the date of the request for the issuance of the detection 
order, having been used in the past 12 months and to an appreciable extent for the 
dissemination of known child sexual abuse material. 


6. As regards detection orders concerning the dissemination of new child sexual abuse 
material, the significant risk referred to in paragraph 4, first subparagraph, point (a), shall 
be deemed to exist where the following conditions are met: 


(a) it is likely that, despite any mitigation measures that the provider may have taken or 
will take, the service is used, to an appreciable extent, for the dissemination of new 
child sexual abuse material; 


(b) there is evidence of the service, or of a comparable service if the service has not yet 
been offered in the Union at the date of the request for the issuance of the detection 
order, having been used in the past 12 months and to an appreciable extent, for the 
dissemination of new child sexual abuse material; 


(c) for services other than those enabling the live transmission of pornographic 
performances as defined in Article 2, point (e), of Directive 2011/93/EU: 
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(1) a detection order concerning the dissemination of known child sexual abuse 
material has been issued in respect of the service; 


(2) the provider submitted a significant number of reports concerning known child 
sexual abuse material, detected through the measures taken to execute the 
detection order referred to in point (1), pursuant to Article 12. 


ae As regards detection orders concerning the solicitation of children, the significant risk 
referred to in paragraph 4, first subparagraph, point (a), shall be deemed to exist where the 
following conditions are met: 


(a) the provider qualifies as a provider of interpersonal communication services; 


(b) it is likely that, despite any mitigation measures that the provider may have taken or 
will take, the service is used, to an appreciable extent, for the solicitation of children; 


(c) there is evidence of the service, or of a comparable service if the service has not yet 
been offered in the Union at the date of the request for the issuance of the detection 
order, having been used in the past 12 months and to an appreciable extent, for the 
solicitation of children. 


The detection orders concerning the solicitation of children shall apply only to 
interpersonal communications where one of the users is a child user’. 


8. The Coordinating Authority of establishment when requesting the issuance of detection 
orders, and the competent judicial or independent administrative authority when issuing the 
detection order, shall target and specify it in such a manner that the negative consequences 
referred to in paragraph 4, first subparagraph, point (b), remain limited to what is strictly 
necessary to effectively address the significant risk referred to in point (a) thereof. 


To that aim, they shall take into account all relevant parameters, including the availability 
of sufficiently reliable detection technologies in that they limit to the maximum extent 
possible the rate of errors regarding the detection and their suitability and effectiveness for 
achieving the objectives of this Regulation, as well as the impact of the measures on the 
rights of the users affected, and require the taking of the least intrusive measures, in 
accordance with Article 10, from among several equally effective measures. 


In particular, they shall ensure that: 


(a) where that risk is limited to an identifiable part or component of a service, the 
required measures are only applied in respect of that part or component; 


7 PCY comment: The PCY concludes that both the term ‘child’ and ‘child user’ as defined at 
present will cause difficult issues requiring further work. 
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(b) where necessary, in particular to limit such negative consequences, effective and 
proportionate safeguards additional to those listed in Article 10(4), (5) and (6) are 
provided for; 


(c) subject to paragraph 9, the period of application remains limited to what is strictly 
necessary. 


9: The competent judicial authority or independent administrative authority shall specify in 
the detection order the period during which it applies, indicating the start date and the end 
date. 


The start date shall be set taking into account the time reasonably required for the provider 
to take the necessary measures to prepare the execution of the detection order. It shall not 
be earlier than three months from the date at which the provider received the detection 
order and not be later than 12 months from that date. 


The period of application of detection orders concerning the dissemination of known or 
new child sexual abuse material shall not exceed 24 months and that of detection orders 
concerning the solicitation of children shall not exceed 12 months. 


Article 8 
Additional rules regarding detection orders 


1. The competent judicial authority or independent administrative authority shall issue the 
detection orders referred to in Article 7 using the template set out in Annex I. Detection 
orders shall include: 


(a) information regarding the measures to be taken to execute the detection order, 
including the indicators to be used and the safeguards to be provided for, including 
the reporting requirements set pursuant to Article 9(3) and, where applicable, any 
additional safeguards as referred to in Article 7(8); 


(b) identification details of the competent judicial authority or the independent 
administrative authority issuing the detection order and authentication of the 
detection order by that judicial or independent administrative authority; 


(c) the name of the provider and, where applicable, its legal representative; 


(d) the specific service in respect of which the detection order is issued and, where 
applicable, the part or component of the service affected as referred to in Article 
7(8); 


(e) whether the detection order issued concerns the dissemination of known or new child 
sexual abuse material or the solicitation of children; 


(f) the start date and the end date of the detection order; 
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(g) a sufficiently detailed statement of reasons explaining why the detection order is 
issued; 


(h) areference to this Regulation as the legal basis for the detection order; 


(i) the date, time stamp and electronic signature of the judicial or independent 
administrative authority issuing the detection order; 


(j) easily understandable information about the redress available to the addressee of the 
detection order, including information about redress to a court and about the time 
periods applicable to such redress. 


2. The competent judicial authority or independent administrative authority issuing the 
detection order shall address it to the main establishment of the provider or, where 
applicable, to its legal representative designated in accordance with Article 24. 


The detection order shall be transmitted to the provider’s point of contact referred to in 
Article 23(1), to the Coordinating Authority of establishment and to the EU Centre, 
through the system established in accordance with Article 39(2). 


The detection order shall be drafted transmitted in any of the official languages declared 
by the provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State authority issuing the order, provided that it is accompanied by a translation of 
at least the most important elements necessary for the execution of the order into any 
of the official languages declared by the provider in accordance with article 23(3). 


Die If the provider cannot execute the detection order because it contains manifest errors or 
does not contain sufficient information for its execution, the provider shall, without undue 
delay, request the necessary clarification to the Coordinating Authority of establishment, 
using the template set out in Annex II. 


4. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annexes I and II where necessary to improve the templates in view of 
relevant technological developments or practical experiences gained. 


Article 9 
Redress, information, reporting and modification of detection orders 


ie Providers of hosting services and providers of interpersonal communications services that 
have received a detection order, as well as users affected by the measures taken to execute 
it, shall have a right to effective redress. That right shall include the right to challenge the 
detection order before the courts of the Member State of the competent judicial authority or 
independent administrative authority that issued the detection order. 
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2 When the detection order becomes final, the competent judicial authority or independent 
administrative authority that issued the detection order shall, without undue delay, transmit 
a-copy_thereefte inform the Coordinating Authority of establishment. The Coordinating 
Authority of establishment shall then, without undue delay, transmit a copy thereof of the 
detection order to all other Coordinating Authorities through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a detection order shall become final upon the 
expiry of the time period for appeal where no appeal has been lodged in accordance with 
national law or upon confirmation of the detection order following an appeal. 


3. Where the period of application of the detection order exceeds 12 months, or six months in 
the case of a detection order concerning the solicitation of children, the Coordinating 
Authority of establishment shall require the provider to report to it on the execution of the 
detection order at least once, halfway through the period of application. 


Those reports shall include a detailed description of the measures taken to execute the 
detection order, including the safeguards provided, and information on the functioning in 
practice of those measures, in particular on their effectiveness in detecting the 
dissemination of known or new child sexual abuse material or the solicitation of children, 
as applicable, and on the consequences of those measures for the rights and legitimate 
interests of all parties affected. 


4. In respect of the detection orders that the competent judicial authority or independent 
administrative authority issued at its request, the Coordinating Authority of establishment 
shall, where necessary and in any event following reception of the reports referred to in 
paragraph 3, assess whether any substantial changes to the grounds for issuing the 
detection orders occurred and, in particular, whether the conditions of Article 7(4) continue 
to be met. In that regard, it shall take account of additional mitigation measures that the 
provider may take to address the significant risk identified at the time of the issuance of the 
detection order. 


That Coordinating Authority shall request to the competent judicial authority or 
independent administrative authority that issued the detection order the modification or 
revocation of such order, where necessary in the light of the outcome of that assessment. 
The provisions of this Section shall apply to such requests, mutatis mutandis. 


Article 10 
Technologies and safeguards 


1. Providers of hosting services and providers of interpersonal communication services that 
have received a detection order shall execute it by installing and operating technologies to 
detect the dissemination of known or new child sexual abuse material or the solicitation of 
children, as applicable, using the corresponding indicators provided by the EU Centre in 
accordance with Article 46. 
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The provider shall be entitled to acquire, install and operate, free of charge, technologies 
made available by the EU Centre in accordance with Article 50(1), for the sole purpose of 
executing the detection order. The provider shall not be required to use any specific 
technology, including those made available by the EU Centre, as long as the requirements 
set out in this Article are met. The use of the technologies made available by the EU Centre 
shall not affect the responsibility of the provider to comply with those requirements and for 
any decisions it may take in connection to or as a result of the use of the technologies. 


The technologies shall be: 


(a) effective in detecting the dissemination of known or new child sexual abuse material 
or the solicitation of children, as applicable; 


(b) not be able to extract any other information from the relevant communications than 
the information strictly necessary to detect, using the indicators referred to in 
paragraph 1, patterns pointing to the dissemination of known or new child sexual 
abuse material or the solicitation of children, as applicable; 


(c) in accordance with the state of the art in the industry and the least intrusive in terms 
of the impact on the users’ rights to private and family life, including the 
confidentiality of communication, and to protection of personal data; 


(d) sufficiently reliable, in that they limit to the maximum extent possible the rate of 
errors regarding the detection. 


The provider shall: 


(a) take all the necessary measures to ensure that the technologies and indicators, as well 
as the processing of personal data and other data in connection thereto, are used for 
the sole purpose of detecting the dissemination of known or new child sexual abuse 
material or the solicitation of children, as applicable, insofar as strictly necessary to 
execute the detection orders addressed to them; 


(b) establish effective internal procedures to prevent and, where necessary, detect and 
remedy any misuse of the technologies, indicators and personal data and other data 
referred to in point (a), including unauthorized access to, and unauthorised transfers 
of, such personal data and other data; 


(c) ensure regular human oversight as necessary to ensure that the technologies operate 
in a sufficiently reliable manner and,where-necessary,in_particular-when_potential 
al " . - . . . 4 \, . a L, . . 3 8. 
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Will be included in a recital. 
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(d) establish and operate an accessible, age-appropriate and user-friendly mechanism 
that allows users to submit to it, within a reasonable timeframe, complaints about 
alleged infringements of its obligations under this Section, as well as any decisions 
that the provider may have taken in relation to the use of the technologies, including 
the removal or disabling of access to material provided by users, blocking the users’ 
accounts or suspending or terminating the provision of the service to the users, and 
process such complaints in an objective, effective and timely manner; 


(e) inform the Coordinating Authority, at the latest one month before the start date 
specified in the detection order, on the implementation of the envisaged measures set 
out in the implementation plan referred to in Article 7(3); 


(f) regularly review the functioning of the measures referred to in points (a), (b), (c) and 
(d) of this paragraph and adjust them where necessary to ensure that the requirements 
set out therein are met, as well as document the review process and the outcomes 
thereof and include that information in the report referred to in Article 9(3). 


=p The provider shall inform users in a clear, prominent and comprehensible way of the 
following: 


(a) the fact that it operates technologies to detect online child sexual abuse to execute the 
detection order, the ways in which it operates those technologies and the impact on 
the confidentiality of users’ communications; 


(b) the fact that it is required to report potential online child sexual abuse to the EU 
Centre in accordance with Article 12; 


(c) the users’ right of judicial redress referred to in Article 9(1) and their rights to submit 
complaints to the provider through the mechanism referred to in paragraph 4, point 
(d) and to the Coordinating Authority in accordance with Article 34. 


The provider shall not provide information to users that may reduce the effectiveness of the 
measures to execute the detection order. 


6. Where a provider detects potential online child sexual abuse through the measures taken to 
execute the detection order, it shall inform the users concerned without undue delay, after 
Eurepelerthe national law enforcement authority of a Member State that received the 
report pursuant to Article 48 has confirmed that the information to the users would not 
interfere with activities for the prevention, detection, investigation and prosecution of child 
sexual abuse offences. 


Article 11 
Guidelines regarding detection obligations 


The Commission, in cooperation with the Coordinating Authorities and the EU Centre and after 
having conducted a public consultation, may issue guidelines on the application of Articles 7 to 10, 
having due regard in particular to relevant technological developments and the manners in which 
the services covered by those provisions are offered and used. 
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Section 3 
Reporting obligations 
Article 12 
Reporting obligations 


Where a provider of hosting services or a provider of interpersonal communications 
services becomes aware in any manner other than through a removal order issued in 
accordance with this Regulation of any information indicating that indicate potential 
online child sexual abuse on its services, it shall promptly submit a report thereon to the 
EU Centre in accordance with Article 13. It shall do so through the system established in 
accordance with Article 39(2). 


Where the provider submits a report pursuant to paragraph 1, it shall inform the user 
concerned, in accordance with the following sub-paragraphs providing information on 
the main content of the reporter the-mannerin-which the provider has become-aware-of 


such_infermation_is—available tethe_previder and on the user’s possibilities of redress, 
including on the right to submit complaints to the Coordinating Authority in accordance 
with Article 34. 


The provider shall inform the user concerned without undue delay, either after having 
received a communication from the EU Centre indicating that it considers the report to be 
manifestly unfounded as referred to in Article 48(2), or after the expiry of a time period of 
six three months from the date of the report without having received a communication 
from the EU Centre indicating that the information is not to be provided as referred to in 
Article 48(6), point (a), whichever occurs first. The time period of six months refered to 
in this subparagraph shall be extended by up to 6 months where so requested by the 
competent authority referred to in Article 48(6)-poimta. 


Where within the three-+menths- time period referred to in the second subparagraph the 
provider receives such a communication from the EU Centre indicating that the 
information is not to be provided, it shall inform the user concerned, without undue delay, 
after the expiry of the time period set out in that communication. 


The provider shall establish and operate an easy to access, accessible, effective, child- 
friendly age-appropriate and user-friendly mechanism that allows users to notify flag to 
the provider information that indicate potential online child sexual abuse on its—the 
service. Those mechanisms shall allow for the submission of notices by individuals or 
entities exclusively by electronic means. 
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The mechanisms shall be such as to facilitate the submission of sufficiently precise 
and adequately substantiated notices. To that end, the providers shall take the 
necessary measures, with particular attention to the needs of the child, to enable and 
to facilitate the submission of notices, with a view to receiving: 


(a) the reasons why the user claims that the notice contains online child sexual 
abuse; 

(b) a clear indication of the online location of the alleged online child sexual abuse 
and, where necessary, additionalinformation specific to a service that enables 
the identification of its online location. 

4. The Commission, in cooperation with Coordinating Authorities and the EU Centre 


and after having conducted a public consultation, shall issue guidelines on the 
application of paragraph 3, having due regard in particular to the child's age, 
maturity, views, needs and concerns. 


Article 13 


Specific requirements for reporting 


1. Providers of hosting services and providers of interpersonal communications services shall 
submit the report referred to in Article 12 using the template set out in Annex III. The 
report shall include: 


(a) 
(b) 
(ba) 


(c) 


(d) 


(c) 


(f) 


(g) 


identification details of the provider and, where applicable, its legal representative; 
the date, time stamp and electronic signature of the provider; 

manner in which the provider became aware of the potential child sexual abuse; 
alt-content data related to the reported potential online child sexual abuse; 
eer ere et 

alt other available data related to the reported potential online child sexual abuse, 


including unique identifiers of the user and metadata related to media files and 
communications; 


whether the potential online child sexual abuse concerns the dissemination of known 
or new child sexual abuse material or the solicitation of children; 


information concerning the geographic location related to the potential online child 
sexual abuse, such as the Internet Protocol address of upload, with associated date 
and time stamp, and port number; 


information concerning the identity of any user involved in the potential online child 
sexual abuse; 
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10 


(h) whether the provider has also reported, or will also report, the information that 
indicate potential online child sexual abuse to a third-country public authority or 
other entity competent to receive such reports ef-athird-ceuntry and if so, which 
authority or entity; 


(i) where the information that indicate potential online child sexual abuse concerns the 
dissemination of known or new child sexual abuse material, whether the provider has 
removed or disabled access to the material; 


(j) whether the provider considers that the report involves an imminent threat to 
the life or safety of a child or requires urgent action; ° 


(k) areference to this Regulation as the legal basis for reporting. 


The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annex III to improve the template where necessary in view of relevant 
technological developments or practical experiences gained. 


In the template of Annex III, section 2, point 1, we could add the reason for the urgency. 


COM text proposal: “(j) whether the report is made in accordance with paragraph 2”. 


COM explanations: The reasons for urgent action are the imminent threat to the life or safety 
of the child. 


10 


COM text proposal: 
oe. 


By deviation from the paragraph 1, where the information referred to in Article 12(1) 
reasonably justifies the conclusion that there is likely to be an imminent threat to the life 
or safety of a child, the report referred to in paragraph | of this Article shall include: 


(a) in any event, the information referred to in points (a), (b), (f), (j) and (k) of paragraph 
1 of this Article; 

(b) the information referred to in the other points of paragraph | of this Article, only 
insofar as that information is immediately available and the inclusion thereof in the 
report does not delay the submission of the report. 


Where the report referred to in the first subparagaph does not contain all information 
referred to in paragraph 1 of this Article in accordance with point (b) of the first 
subaparagraph, the provider of hosting services or of interpersonal communications 
services concerned shall be promptly submit an additional report containing all that 
information, updated or completed where relevant. That additional report shall include a 
reference to the initial report submitted in accordance with the first subparagaph and shall 
indicate which information has been updated or completed.” 
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Article 13a!! 


Emergency reporting 


i In the case of an imminent threat to the life or safety of a child, the providers of 
hosting services and providers of interpersonal communications services shall 
promptly and directly, in addition to paragraph 1(j) of Article 13, inform authorities 
competent to for the investigation and prosecution of criminal offences in the 
Member States concerned!”. Where the provider cannot identify with reasonable 
certainty the Member State concerned, it shall inform the law enforcement 
authorities of the Member State in which it is established or where its legal 
representative resides or is established and inform Europol’. 


2 For the purpose of paragraph 1, the Member State concerned shall be the 
Member State in which the offence is suspected to have taken place, to be taking place 
or to be likely to take place, or the Member State where the suspected offender 
resides or is located, or the Member State where the victim of the suspected offence 
resides or is located. 


Section 4 
Removal obligations 


Article 14 


Removal orders 


oe ee 


Cee a ie eee ee 
aa ea, pahhis wee ean pe Coens Bee 


identified as Stee eid seeail abuse aural 


1. The competent authority shall have the power to issue a removal order, in accordance 
with relevant national requirements, requiring a provider of hosting services to 
remove or disable access in all Member States of one or more specific items of 
material that, after a diligent assessment, the Coordinating Authority- orthe courts or 
ether +ndependent administrathe-authorties referred +oin Article 364 is identified as 


constituting child sexual abuse material. 


= COM comment: as mentioned in the last LEWP, it would be best to not create a parallel 
procedure and delete this Article, and instead reinforce the existing procedure if needed to 
further speed-up the process in cases of emergency (e.g. reduced reporting requirements — see 
new Art. 12(2), and simplified filtering requirements at the EU Centre — see new paragraph). 

12 Wording copied from Art. 14(5) of the TCO Regulation. 

13 Wording copied from Art. 18(2) of the DSA. 
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The provider shall execute the removal order as soon as possible and in any event within 
24 4 hours of receipt thereof. The provider shall take the necessary measures to ensure 
that it is capable to reinstate the material or access thereto in accordance with Article 
15(1a). 


A removal order shall be issued using the template set out in Annex IV. Removal orders 
shall include: 


(a) identification details of the cempetent—judicialor—ndependent—administrative 
authority issuing the removal order and authentication of the removal order by that 
authority; 


(b) the name of the provider and, where applicable, of its legal representative; 
(c) the specific service in respect of fer which the removal order is issued; 


(d) a sufficiently detailed statement of reasons explaining why the removal order is 
issued-and 4n-particular-why the material constitutes-chid sexual abuse materiak 


14 


COM proposal: “By deviation from the first subparagraph, and without causing undue delays 
in the process of issuance of those orders, Member States may decide that such orders can 
only be issued by a judicial authority at the request of the competent authority. Where a 
Member State makes use of this possibility, it shall inform the Commission thereof and keep 
it up-to-date. The Commission shall make the information received publicly available and 
keep it up-to-date.” 


COM suggestion to accompany by a recital: “In order to allow Member States to organise the 
process of issuance of removal, blocking or delisting orders in a manner compatible with their 
respective constitutional requirements and to enhance prior judicial control where deemed 
appropriate, they should have the possibility to require their respective competent authorities 
to request the competent judicial authority of the Member State concerned to issue some or all 
of those three types of orders under this Regulation. That possibility to derogate should 
however only concern the question which authority issues the orders. Accordingly, when a 
Member State makes use of that possibility, the competent authority concerned should remain 
responsible for assessing the need for the order at stake and for complying with all of the 
procedural requirements of this Regulation related to its preparation and follow-up. In that 
case, whilst it is for the competent judicial authority to conduct an additional verification of 
whether the conditions of this Regulation for issuing the order in question have been met, 
those conditions themselves should remain unaltered and be applied consistently across the 
Union. In the interest of effectiveness, that possibility should be subject to the Member State 
concerned taking all reasonable measures to ensure that the issuance of the orders by their 
judicial authorities does not lead to any undue delays. In addition, in the interest of 
transparency and legal certainty, it should be ensured that the necessary information regarding 
the use of the possibility is publicly available.” 
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(da) where applicable, a statement of reasons explaining why the order is issued to a 
service provider that does not have its main establishment or legal 
representative in the Member State of the issuing authority according to the 
procedure provided for in Article 14a; 


(ec) anexactunform+resourcetocator and where necessary, additional clear information 
fortheidentification_of enabling the provider to identify and locate the child 
sexual abuse material; 


(f) where applicable, the information about non-disclosure during a specified time 
period, in accordance with Article 15(4), point (c); 


(fa) reporting requirements pursuant to point 7; 


(g) areference to this Regulation as the legal basis for the removal order; 


(h) the date, time stamp and electronic signature of the j#dtetal-or—independent 
administrative-competent authority issuing the removal order; 


(i) easily understandable information about the redress available to the addressee of the 
removal order, including information about redress to a court and about the time 
periods applicable to such redress. 


4. The judicial -autherityorthe independent administrative authority issuing the removal 
order shall address it to the main establishment of the provider or, where applicable, to its 
legal representative designated in accordance with Article 24. 


It-shall transm# The removal order shall be transmitted to the the provider’s point of 
contact referred to in Article 23(1) by electronic means capable of producing a written 
record under conditions that allow to establish the authentication of the sender, including 
the accuracy of the date and the time of sending and receipt of the order, to the 
Coordinating Authority efestablishment and to the EU Centre, through the system 
established in accordance with Article 39(2). 


It shall draft transmit the removal order in any of the official languages declared by the 
provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State issuing the order, provided that it is accompanied by a translation of at least the 
most important elements necessary for the execution of the order into any of the 
official languages declared by the provider in accordance with article 23(3). 


a If the provider cannot execute the removal order on grounds of force majeure or de facto 
impossibility not attributable to it, including for objectively justifiable technical or 
operational reasons, it shall, without undue delay, inform the authority issuing the order 
efestablishment of those grounds, using the template set out in Annex V. 


The time period set out in paragraph 24 shall start to run as soon as the reasons referred to 
in the first subparagraph have ceased to exist. 
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6. If the provider cannot execute the removal order because it contains manifest errors or does 
not contain sufficient information for its execution, it shall, without undue delay, request 
the necessary clarification te from the authority issuing the order of establishment, using 
the template set out in Annex V. 


The time period set out in paragraph 24 shall start to run as soon as the provider has 
received the necessary clarification. 


cE The provider shall, without undue delay and using the template set out in Annex VI, 
inform the issuing authority, Coordinating Authority of establishment and the EU Centre 
of the measures taken to execute the removal order, indicating, in particular, whether the 
provider removed the child sexual abuse material or disabled access thereto in all Member 
States and the date and time thereof. 


8. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annexes IV, V and VI where necessary to improve the templates in view 
of relevant technological developments or practical experiences gained. 


Article 14a 
Procedure for cross-border removal orders 


i Subject to Article 14, where the hosting service provider does not have its main 
establishment or legal representative in the Member State of the authority that issued 
the removal order, that authority shall, simultaneously to issuing the order to the 
hosting service provider, transmit a copy of the removal order to the Coordinating 
Authority of the Member State where the hosting service provider has its main 
establishment or where its legal representative resides or is established. If the 
receiving Coordinating Authority is not the competent authority, it shall transmit the 
order to the competent authority for the purpose of the procedure of this Article. 


va Where a hosting service provider receives a removal order as referred to in this 
Article, it shall take the measures provided for in Article 14 and take the necessary 
measures to be able to reinstate the content or access thereto, in accordance with 
paragraph 6 of this Article. 


3. The Cooerdinatine Authorityorthe competent authority of the Member State where 


the hosting service provider has its main establishment or where its legal 
representative resides or is established may, on its own initiative, within 72 hours of 
receiving the copy of the removal order in accordance with paragraph 1, scrutinise 
the removal order to determine whether it seriously or manifestly infringes this 
Regulation or the fundamental rights and freedoms guaranteed by the Charter. 


Where it finds an infringement, it shall, within the same period, adopt a reasoned 
decision to that effect. 
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la. 


The Coordinating Authority—or—the competent authority shall, before adopting a 


decision pursuant to the second subparagraph of paragraph 3, inform the competent 
authority that issued the removal order of its intention to adopt the decision and of its 
reasons for doing so. 


Where the Coordinating Authority—orthe competent authority adopts a reasoned 


decision in accordance with paragraph 3 of this Article, it shall, without delay, 
transmit that decision, if necessary through the Coordinating Authority, to the 
authority that issued the removal order, the hosting service provider and the EU 
Centre. 


Where the decision finds an infringement pursuant to paragraph 3 of this Article, the 
removal order shall cease to have legal effects. 


Upon receiving a decision finding an infringement communicated in accordance with 
paragraph 5, the hosting service provider concerned shall without undue delay 
reinstate the content or access thereto, without prejudice to the possibility to enforce 
its terms and conditions in accordance with Union and national law. 


Article 15 
Redress and provision of information 


Providers of hosting services that have received a removal order issued in accordance with 
Article 14, as well as the users who provided the material, shall have the right to an 
effective redress. That right shall include the right to challenge such a removal order before 


the courts of the Member State of the competent udicialautherityorindependent 
administrative authority that issued the removal order. 


If the order is repealed as a result of a redress procedure, the provider shall without 
undue delay reinstate the material or access thereto, without prejudice to the 
possibility to enforce its terms and conditions in accordance with Union and national 
law). 


When the removal order becomes final, the cempetentjudicialauthorty—or independent 


administrative authority that issued the removal order shall, without undue delay, transmit 
a copy thereof and copies of the information it has received pursuant to Article 14 (5) 
to (7) to the Coordinating Authority efestablishment. The Coordinating Authority of 
establishment shall then, without undue delay, transmit a-cepy copies thereof to all other 
Coordinating Authorities and the EU Centre through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a removal order shall become final upon the 
expiry of the time period for appeal where no appeal has been lodged in accordance with 
national law or upon confirmation of the removal order following an appeal. 


15 


Wording copied from Art. 4(7) of the TCO Regulation. 
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3: Where a provider removes or disables access to child sexual abuse material pursuant to a 
removal order issued in accordance with Article 14, it shall without undue delay, inform 
the user who provided the material of the following: 


(a) the fact that it removed the material or disabled access thereto; 


(b) the reasons for the removal or disabling, providing a copy of the removal order upon 
the user’s request; 


(c) the user’s right to judicial redress referred to in paragraph 1 and the user’s right to 
submit complaints to the Coordinating Authority in accordance with Article 34. 


3a. The provider shall establish and operate an accessible, age-appropriate and user- 
friendly mechanism that allows users to submit to it complaints about alleged 
infringements of its obligations under this Section. It shall process such complaints in 
an objective, effective and timely manner. 


4. The i dssuing aieenes oo yy decide dees ie 


reiiovel auiee and aes navine dousilied if neces with sievant public sikeohes 
that the provider is not to disclose any information regarding the removal of or disabling of 
access to the child sexual abuse material, where and to the extent necessary to avoid 
interfering with activities for the prevention, detection, investigation and prosecution of 
child sexual abuse or related criminal offences. 


In such a case: 


(a) the #idictal-autheritor independent-administrative—authority issuing the removal 


order shall inform the provider of its decision specifying the applicable time 
period that shall be setthe+ime-peried not longer than necessary and not exceeding 
twelve six-weeks, during which the provider is not to disclose such information; 


(b) the obligations set out in paragraph 3 shall not apply during that time period; 


orovidl omy pees ieee is el ble ee eeicd: 


The issuing Fhatjudiciel authority or independent administrative authority may decide to 
extend the time period referred to in the second subparagraph, point (a), by a further time 
period of maximum six weeks, where and to the extent the non-disclosure continues to be 
necessary. In that case, the issuing that judicial authorityor independent administrative 
authority shall inform the provider of its decision, specifying the applicable time period. 
Article 14(3) shall apply to that decision. 
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la. 


Section 5 
Blocking obligations 


Article 16 


Blocking orders 
bas sear ape authority pagan caat a Ruta TT nae pass ae y te 


as cile tae ie ates of that Meesber State. 6 issue a "blocks m. « in 


accordance with relevant national requirements, requiring a provider of internet access 
services under the jurisdiction of that Member State to take reasonable measures to prevent 


users from accessing knewn child sexual abuse material indicated by-al-uniform- resource 
a ieee an oman rm Vaneau in 


The provider shall execute the blocking order as soon as possible and in any event 


within a reasonable time period set by the issuing authority ene—week—of receipt 


thereof. The provider shall take the necessary measures to ensure that it is capable of 
reinstating access in accordance with Article 18(1a). 


2 Fe-Ceerdinatine Adtherh—et establshaent stat before pectestHie the tastiest 


Bloeltic—erder—eates—ort alt ee estisations ad i ehert ets te ceasitee te det eri] 
eer 143 : AI 
Fethatend,it shal, where-appropriate: 


oF Artile = point 


Coat A ies see E ENTE 


(b) REA, eRe anes Ria reae meni aremate cere 


as. 


presdeastinanetat aacteehrelocieat capabilities and ice: 


16 


COM proposal: “By deviation from the first subparagraph, and without causing undue delays 
in the process of issuance of those orders, Member States may decide that such orders can 
only be issued by a judicial authority at the request of the competent authority. Where a 
Member State makes use of this possibility, it shall inform the Commission thereof and keep 
it up-to-date. The Commission shall make the information received publicly available and 
keep it up-to-date.” 


7842/23 


FL/ml 26 


ANNEX JALI LIMITE EN 


(e} a " EU—Centre—to ates =e necessary aan Gian 


ae Be oop tic 6 eee Ogee a 
blocking order shall be issued; where it-coensiders-that the following conditions are met: 


(a) other equally effective and less intrusive measures'’ than blocking cannot be 
taken to prevent access to child sexual abuse material or it is likely that such 


measure will fail; there-is-evidence-ofthe service having been_used during the past 
42-menths,_te—an_appreciable_extent, for_accessine—or_attemptineto—access—chid 


al ‘al indicated be {Wkanid ) 


(b) the blocking order is necessary to prevent the dissemination of the-child sexual abuse 


material te-users in the Union, having regard in-particulartethe-quantitand nature 
Ores to Be neve to | ie the eu ve ane victims pier aceon ane 


(d) the reasons for issuing the blocking order outweigh negative consequences for the 
rights and legitimate interests of all parties affected, having regard in particular to the 
need to ensure a fair balance between the fundamental rights of those parties, 
including the exercise of the users’ freedom of expression and information and the 
provider’s freedom to conduct a business. 


When assessing whether the conditions of the first subparagraph have been met, account 
shall be taken of all relevant facts and circumstances of the case at hand-inehidinge any 
information_obtained_pursuant te_paragraph 2 _and the -ews-of the _provider_submitted 4n 
accordanceswith-_parasraph 3. 


17 PCY comment: an example of “less intrusive measures” can for instance be a removal order 


that cannot be executed. 


7842/23 FL/ml 27 
ANNEX JALI LIMITE EN 


ae Se ove Sedans ane issuance eee eae 


A plociaug idler: shall: 


(a) +where—necessary, specify effective—and—prepertionate limits and—safeguards 
necessary to ensure that a blocking order is targeted and that any negative 
consequences referred to in paragraph 4, point (d), remain limited to what is strictly 
necessary; 


(b) subject to paragraph 6, ensure that the period of application remains limited to what 
is strictly necessary. 


6. The issuing Coerdinatine—authority shall specify in the blocking order the period during 
which it applies, indicating the start date and the end date. 


The period of application of blocking orders shall not exceed five years. 


7. In-respect_of the_blockine—orders_that the-competent judicial _autherityor_independent 
admnistrative-authority issued _at its request+The Coordinating Authority or the issuing 
authority shall, where necessary and at least once every year, assess whether any 
substantial changes to the grounds for issuing the blocking orders have occurred and 
particular, whether the conditions of paragraph 4 continue to be met. 


ee 


pevaceaan of fick pede wWhere necessary in the light at the: Sutconie of that qseeccnieait 


or te—take—account—of justified +equests—or other relevant information, including 
information obtained through the reports referred to in Article +8 17(5a) and—6), 


respectively an order shall be modified or repealed by the issuing authority, where 
relevant at the request of the Coordinating Authority. Fhe-previsiens_of this-Section 


Article 17 


Additional rules regarding blocking orders 


1. Fhe-Coordinatine Authority of establishment shall issuethe A blocking orders-+referred+e 
in-Articlet6 shall be issued using the template set out in Annex VII. Blocking orders shall 


include: 
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(a) pee eee Oe ee pio eee Sy iat ae fas 
et aN 16(3)_and, ee oie ie ae 
pursuant te Article 18(6)!8: 

(b) identification details of the cempetent—udicial_authority—or—the—independent 
administrative authority issuing the blocking order and authentication of the blocking 
order by that authority; 

(c) the name of the provider and, where applicable, its legal representative; 

(d) clear information enabling the provider to identify and locate the child sexual 
abuse material-the-specifie service in respect of which the detection orderis issued; 

(e) the start date and the end date of the blocking order; 

(ea) the limits referred to in Article 16(5); 

(f) a sufficiently detailed statement of reasons explaining why the blocking order is 
issued; 

(fa) reporting requirements pursuant to paragraph 5a; 

(g) areference to this Regulation as the legal basis for the blocking order; 

(h) the date, time stamp and electronic signature of the edicial _autherity—or—the 
independent administrative-authority issuing the blocking order; 

(i) easily understandable information about the redress available to the addressee of the 
blocking order, including information about redress to a court and about the time 
periods applicable to such redress. 

2. The competentjudicial_autherity_or—independent_administrative authority issuing the 


blocking order shall address it to the main establishment of the provider or, where 
applicable, to its legal representative designated in accordance with Article 24. 


8 PCY comment: the proposal means that a blocking order can only be issued if the subject- 
matter of the blocking is on the list provided for by the EU Centre. This list is compiled 
according to Article 36(1)(b) that stipulates additional requirements, including that the 
blocked online location must be displayed from a third country. Do Member States think 
that there should be such a requirement? Or should it be sufficient that Member States 
share their blocking orders with the EU Centre and other Member States once they 
become final? 
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4a. 


5a. 


The blocking order shall be transmitted to the provider’s point of contact referred to in 
Article 23(1) by electronic means capable of producing a written record under 
conditions that allow to establish the authentication of the sender, including the 
accuracy of the date and the time of sending and receipt of the order, to the 
Coordinating Authority ef-establishment and to the EU Centre, through the system 
established in accordance with Article 39(2). 


The blocking order shall be drafted-transmitted in any of the official languages declared 
by the provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State issuing the order, provided that it is accompanied by a translation of at least the 
most important elements necessary for the execution of the order into any of the 
official languages declared by the provider in accordance with article 23(3). 


If the provider cannot execute the blocking order on grounds of force majeure or de 
facto impossibility not attributable to it, including for objectively justifiable technical 
or operational reasons, it shall, without undue delay, inform the authority issuing the 
order of those grounds, using the template set out in Annex yy. 


If the provider cannot execute the blocking order because it contains manifest errors or 
does not contain sufficient information for its execution, the provider shall, without undue 
delay, request the necessary clarification te from the authority issuing the order 


Coordinating Authority of establishment using the template set out in Annex VIII. 


The provider shall, without undue delay and using the template set out in Annex xx, 
inform the issuing authority of the measures taken to execute the blocking order, 
indicating, in particular, whether the provider has prevented access to child sexual 
abuse material. 


The authority issuing the order may require the provider to report to it at regular 
intervals on the measures taken and their functioning to execute a blocking order, 
including the effective and proportionate limitations and safeguards provided for. 


Upon request of the issuing authority, the provider shall also provide, without undue 
delay, such reports or any other information relating to the execution of the blocking 
order needed for the purpose of the assessment referred to in Article 16(7). 


The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annexes VII, yy, asd-VIII and xx where necessary to improve the 
templates in view of relevant technological developments or practical experiences gained. 
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Article 18 


Redress and provision of information nformation-and+eportine-of blecking-orders 


1. Providers of internet access services that have received a blocking order;as-wel-as and 
users who provided er-were-prevented from-accessins-a-specticiten-of blocked material 
indicated by the unHform resource tecators_in execution of such orders, shall have a right to 
effective redress. That right shall include the right to challenge the blocking order before 
the courts of the Member State of the competent—judicial authority—orindependent 
administrative authority that issued the blocking order. 


la. If the order is repealed as a result of a redress procedure, the provider shall without 
undue delay reinstate access to the material, without prejudice to the possibility to 
enforce its terms and conditions in accordance with Union and national law. 


2, When the blocking order becomes final, the eempetentpidicial-autherityor independent 
admitstrative authority that issued the blocking order shall, without undue delay, transmit 
a copy thereof and copies of information it has received pursuant to Article 17 (4a) to 
(5a) the Coordinating Authority of establishment..The Coordinating Authority of 
establishment shall then, without undue delay, transmit a-cepy¥ copies thereof to all other 
Coordinating Authorities and the EU Centre through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a blocking order shall become final upon the 
expiry of the time period for appeal where no appeal has been lodged in accordance with 
national law or upon confirmation of the removal order following an appeal. 


2: The provider shall establish and operate an accessible, age-appropriate and user-friendly 
mechanism that allows users to submit to it-within-a+reasonable timeframe; complaints 
about alleged infringements of its obligations under this Section. It shall process such 
complaints in an objective, effective and timely manner. 


4. Where a provider prevents users from accessing child sexual abuse material the-aniform 
resource tecaters pursuant to a blocking order issued+n-accordance-with Article, it shall 
take reasonable measures to inform-the those users of the following: 


(a) the fact that it does so pursuant to a blocking order; 


(c) the users? right of users who provided the blocked material to judicial redress 
referred to in paragraph 1, thet rights of users to submit complaints to the provider 
through the mechanism referred to in paragraph 3 and to the Coordinating Authority 


in accordance with Article 34-as-wel-asthet +icht te-submitthe requests referred to 
in-paragraphs. 
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5. ee 


Besa oe Tau ee “safeguards prowfliiafor. pn halfway 


three the peried ofapetedtion 


Section 5a 
Delisting obligations 


Article 18a 
Delisting orders 


1. The competent authority shall have the power to issue an order, in accordance with 
relevant national requirements, requiring a provider of online search engines under 
the jurisdiction of that Member State to take reasonable measures to delist an online 
location where child sexual abuse material can be found from appearing in search 
results, !° 


Zs The provider shall execute the delisting order without undue delay and in any event 
within a reasonable time period set by the issuing authority-eone-week of receipt of the 
erder. The provider shall take the necessary measures to ensure that it is capable of 
reinstating the delisted online location to appear in search results in accordance with 
Article 18¢(2). 


19 COM proposal: “By deviation from the first subparagraph, and without causing undue delays 


in the process of issuance of those orders, Member States may decide that such orders can 
only be issued by a judicial authority at the request of the competent authority. Where a 
Member State makes use of this possibility, it shall inform the Commission thereof and keep 
it up-to-date. The Commission shall make the information received publicly available and 
keep it up-to-date.” 
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A delisting order shall be issued where the following conditions are met: 


(a) the delisting is necessary to prevent the dissemination of the child sexual abuse 
material in the Union, having regard in particular to the need to protect the 
rights of the victims; 


(b) search results correspond, in a sufficiently reliable manner, to online locations 
where child sexual abuse material can be found. 


4. The issuing authority shall specify in the delisting order the period during which it 
applies, indicating the start date and the end date. 
The period of application of delisting orders shall not exceed five years. 
5. The Coordinating Authority or the issuing authority shall, where necessary and at 
least once every year, assess whether any substantial changes to the grounds for 
issuing the delisting orders have occurred and whether the conditions of paragraph 4 
continue to be met. 
Where necessary in the light of the outcome of that assessment or information of the 
reports referred to in Article 18b(6) an order may be modified or repealed by the 
issuing authority, where relevant at the request of the Coordinating Authority. 
Article 18b 
Additional rules regarding delisting orders 
1. A delisting order shall be issued using the template set out in annex zz. Delisting 
orders shall include: 
(a) identification details of the authority issuing the delisting order and 
authentication of the order by that authority; 
(b) the name of the provider and, where applicable, its legal representative; 
(c) clear information enabling the provider to identify and locate the child sexual 
abuse material; 
(d) the start and end date of the delisting; 
(e) a sufficiently detailed statement of reasons explaining why the delisting order is 
issued; 
(f) reporting requirements pursuant to point 6; 
(g) areference to this Regulation as the legal basis for delisting; 
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(h) the date, time stamp and electronic signature of the authority issuing the 
delisting order; 


(i) easily understandable information about the redress available, including 
information about redress to a court and about the time periods applicable to 
such redress. 


The authority issuing the delisting order shall address it to the main establishment of 
the provider or, where applicable, to its legal representative designated in accordance 
with Article 24. 


The delisting order shall be transmitted to the provider’s point of contact referred to 
in Article 23(1) by electronic means capable of producing a written record under 
conditions that allow to establish the authentication of the sender, including the 
accuracy of the date and the time of sending and receipt of the order to the 
Coordinating Authority ef-establishment and to the EU Centre, through the system 
established in accordance with Article 39(2). 


The delisting order shall be transmitted in any of the offical languages declared by 
the provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State issuing the order, provided that it is accompanied by a translation of at least the 
most important elements necessary for the execution of the order into any of the 
offical languages declared by the provider in accordance with Article 23(3). 


If the provider cannot execute the delisting order on grounds of force majeure or de 
facto impossibility not attributable to it, including for objectively justifiable technical 
or operational reasons, it shall, without undue delay, inform the authority issuing the 
order of those grounds, using the template set out in Annex qq. 


If the provider cannot execute the delisting order because it contains manifest errors 
or does not contain sufficient information for its execution, the provider shall, without 
undue delay, request the necessary clarification from the authority issuing the order, 
using the template set out in Annex pp. 


The provider shall, without undue delay and using the template set out in Annex ww, 
inform the issuing authority of the measures taken to execute the delisting order, 
indicating, in particular, whether the provider has prevented search results for the 
online location with child sexual abuse material to appear. 


The authority issuing the order may require the provider to report to it regularly on 
the measures taken to execute a delisting order. 


The Commission shall be empowered to adopt delegated acts in accordance with 
Article 86 in order to amend Annexes zz, qq and pp where necessary to improve the 
templates in view of relevant technological developments or practical experiences 
gained. 
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3a. 


Article 18c 
Redress and provision of information 


Providers of online search engines that have received a delisting order and users that 
provided the material to a delisted online location shall have a right to effective 
redress. That right shall include the right to challenge the delisting order before the 
courts of the Member State of the authority that issued the delisting order. 


If the order is repealed as a result of a redress procedure, the provider shall without 
undue delay reinstate the delisted online location to appear in search results, without 
prejudice to the possibility to enforce its terms and conditions in accordance with 
Union and national law. 


When the delisting order becomes final, the issuing authority shall, without undue 
delay, transmit a copy thereof and information it has received pursuant to Article 18b 
(4) to (6) to the Coordinating Authority of establishment. The Coordinating Authority 
of establishment shall then, without undue delay, transmit a copies thereof to all other 
Coordinating Authorities and the EU Centre through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a delisting order shall become final upon 
the expiry of the time period for appeal where no appeal has been lodged in 
accordance with national law or upon confirmation of the delisting order following an 
appeal. 


The provider shall establish and operate an accessible, age-appropriate and user- 
friendly mechanism that allows users to submit to it complaints about alleged 
infringements of its obligations under this Section. It shall process such complaints in 
an objective, effective and timely manner. 


Where a provider prevents users from obtaining search results for child sexual abuse 
material corresponding to an online location pursuant to a delisting order, it shall 
take reasonable measures to inform users that provided the material to a delisted 
online location and those users of the following: 


(a) the fact that it does so pursuant to a delisting order; 


(b) the right of users that provided the material to a delisted online location to 
judicial redress referred to in paragraph 1 and users’ right to submit 
complaints to the Coordinating Authority in accordance with Article 34. 
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Section 6 
Additional provisions 


Article 19 


Liability of providers 


Providers of relevant information society services shall not be liable for child sexual abuse offences 
if selehbeeause they carry out, in good faith, the-necessary activities to comply with the 


requirements—of this Regulation, in particular activities aimed at assessing and mitigating risk, 
detecting, identifying, reporting, removing, disabling efaccess to, blocking or delisting from 
search results reporting online child sexual abuse #+-accerdance-with these requirements. 


Article 20 


Victims’ right to information 


i Persons residing in the Union shall have the right to receive, upon their request, from the 
Coordinating Authority designated-by in the Member State where they reside, information 
regarding any instances where the dissemination of known child sexual abuse material 
depicting them is reported to the EU Centre pursuant to Article 12. Persons with 
disabilities shall have the right to ask and receive such an information in a manner 
accessible to them. 

That Coordinating Authority shall transmit the request to the EU Centre through the 
system established in accordance with Article 39(2) and shall communicate the results 
received from the EU Centre to the person making the request. 

Ds The request referred to in paragraph | shall indicate: 

(a) the relevant item or items of known child sexual abuse material; 
(b) where applicable, the individual or entity that is to receive the information on behalf 
of the person making the request; 
(c) sufficient elements to demonstrate the identity of the person making the request. 
Be The information referred to in paragraph | shall include: 
(a) the identification of the provider that submitted the report; 
(b) the date of the report; 
(c) whether the EU Centre forwarded the report in accordance with Article 48(3) and, if 
so, to which authorities; 
(d) whether the provider reported having removed or disabled access to the material, in 
accordance with Article 13(1), point (1). 
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Article 21 
Victims’ right of assistance and support for removal 


1. Providers of hosting services shall provide reasenable-assistance, on request, to persons 
residing in the Union that seek to have one or more specific items of known child sexual 
abuse material depicting them removed or to have access thereto disabled by the provider. 


2: Persons residing in the Union shall have the right to receive support—upern+thet+request 
from the Coordinating Authority designated-by in the Member State where they-persen 
resides; to request assistance,suppert from the EU Centre when they seek to have a 
provider of hosting services remove or disable access to one or more specific items of 
known child sexual abuse material depicting them. Persons with disabilities shall have the 
right to ask and receive any information relating to such support in a manner accessible to 
them.?2 


That Coordinating Authority shall transmit the request to the EU Centre through the 
system established in accordance with Article 39(2) and shall communicate the results 


received from the EU Centre to the person making the request. 


a: The requests referred to in paragraphs | and 2 shall indicate the relevant item or items of 
child sexual abuse material. 


4. The EU Centre’s support referred to in paragraph 2 shall include, as applicable: 


(b) verifying whether the provider removed or disabled access to that item or those 
items, including by conducting the searches referred to in Article 49(1); 


(c) notifying the item or items of known child sexual abuse material depicting the person 
to the provider and requesting removal or disabling of access, in accordance with 
Article 49(2); 


(d) where necessary, informing the Coordinating Authority of establishment of the 
presence of that item or those items on the service, with a view to the issuance of a 
removal order pursuant to Article 14. 


20 PCY comment: it has been suggested to include a deadline by which to inform the victim. 


7842/23 FL/ml Ey 
ANNEX JALI LIMITE EN 


Article 22?! 
Preservation of information 


1. Providers of hosting services and providers of interpersonal communications services shall 
preserve the necessary content data and other data processed #7 connection tothe measures 
taken to comply with this Regulation and the personal data generated through such 
processing, when the following measures have been taken or for the purposes of 
complaints or redress procedures cemplaints—onbyfer—one—or—more—of the folowing 


purpeses, as applicable: 


(a) executing a-detection-order issued_pursuantteArticle-7or a removal order issued 
pursuant to Article 14 for-ablecking-orderpursuant_to—Article 16-0ra-delisting 
order pursuant to Article 18a |; 


(b) reporting information that indicate potential online child sexual abuse to the EU 
Centre pursuant to Article 12; 


21 COM proposal: 


1) The proposed deletion of detection order here was conditional to the inclusion of a new 
paragraph explaining the need to preserve information related to detection orders, as follows: 
“insofar as strictly necessary for using the technologies referred to in Article 10, involving in 
particular the automatic, intermediate and temporary preservation of such data for the use of 
the indicators provided by the EU Centre, as well as for applying the safeguards referred to in 
Article 10, when executing a detection order issued pursuant to Article 7;” 


2) Recital 39 could be amended as follows: “(39) To avoid disproportionate interferences with 
users’ rights to private and family life and to protection of personal data, the data related to 
instances of potential online child sexual abuse should not be preserved by providers of 
relevant information society services, unless and for no longer than necessary for one or more 
of the purposes specified in this Regulation and subject to an appropriate maximum duration. 


In that regard, the requirements to preserve such data in connection to the execution of 
detection orders should not be understood as allowing or requiring the preservation of 
all users’ data processed for such detection purposes in general. They should rather be 
understood as requiring only the preservation of content data and other data processed 
insofar as this is strictly necessary to use the relevant technologies meeting the 
requirements of this Regulation, covering in particular caching-like activities involving 
the automatic and intermediate preservation for purely technical reasons and for very 
short periods of time needed to use the relevant indicators to detect possible child sexual 
abuse online, as well as to apply the safeguards required under this Regulation in 
connection to the use of those technologies, covering in particular the application of 


measures to prevent, detect and remedy misuse, to ensure regular human oversight and 
to carry out regular reviews. As those preservation requirements relate only to this 


Regulation, they should not be understood as affecting the possibility to store relevant content 
data and traffic data in accordance with Directive 2002/58/EC or the application of any legal 
obligation to preserve data that applies to providers under other acts of Union law or under 
national law that is in accordance with Union law.” 
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la. 


(c) blocking the account of, or suspending or terminating the provision of the service to, 
the user concerned; 


(d) handling users’ complaints to the provider or to the Coordinating Authority, or the 
exercise of users’ right to administrative or judicial redress, in respect of alleged 
infringements of this Regulation. 


(e}— 


Upon a request respending—to—requests issued by a competent law—enfercement 
authority#es and +adicial-_autherities—[in accordance with the applicable law], providers 
shall with-a-view-te provideing them requesting authority with the necessary information 
for the prevention, detection, investigation or prosecution of child sexual abuse offences; 
or the handling of complaints or admininstrative or judicial redress proceedings, 
insofar as the content data and other data have been preserved for one of the purposes in 
paragraphs 1(a) to (d). relate te-a-report that the provider has-submitted te the EU Centre 
pursuantte Article 42, 


As regards the first subparagraph, point (a), the provider may also preserve the information 
for the purpose of improving the effectiveness and accuracy of the technologies to detect 
online child sexual abuse for the execution of a detection order issued to it in accordance 
with Article 7. However, it shall not store any personal data for that purpose. 


Providers shall preserve the information referred to in paragraph 1 for no longer than 
necessary for the applicable purpose and, in any event, no longer than 12 months from the 
date of the measures taken that led to the obligation to preserve the content data and 
other data processed-reporting-or-ofthe removal or disabling of access, whicheveroceurs 
first. 


Providers Fhey—shall, upon request from the competent #atienalauthority —er—court, 
preserve the information for a further specified period, set by thatthe requesting authority 
ereourt-where and to the extent necessary for ongoing administrative or judicial redress 
proceedings, as referred to in paragraph 1, point (d). 


Providers shall ensure that the information referred to in paragraph 1 is preserved in a 
secure manner and that the preservation is subject to appropriate technical and 
organisational safeguards. Those safeguards shall ensure, in particular, that the information 
can be accessed and processed only for the purpose for which it is preserved, that a high 
level of security is achieved and that the information is deleted upon the expiry of the 
applicable time periods for preservation. Providers shall regularly review those safeguards 
and adjust them where necessary. 


When a detection order pursuant to Article 7, a removal order issued pursuant to 


b) = S 
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Article 23 
Points of contact 


i Providers of relevant information society services shall establish a single point of contact 
allowing for direct communication, by electronic means, with the Coordinating 
Authorities, other competent authorities of the Member States, the Commission and the EU 
Centre, for the application of this Regulation. 


De The providers shall communicate to the EU Centre and make public the information 
necessary to easily identify and communicate with their single points of contact, including 
their names, addresses, the electronic mail addresses and telephone numbers. 


3. The providers shall specify in the information referred to in paragraph 2 the official 
language or languages of the Union, which can be used to communicate with their points 
of contact. 


The specified languages shall include at least one of the official languages of the Member 
State in which the provider has its main establishment or, where applicable, where its legal 
representative resides or is established. 


Article 24 
Legal representative 


1. Providers of relevant information society services which do not have their main 
establishment in the Union shall designate, in writing, a natural or legal person as its legal 
representative in the Union for the purposes of this Regulation. 


2s The legal representative shall reside or be established in one of the Member States where 
the provider offers its services. 


3. The provider shall mandate its legal representatives to be addressed in addition to or 
instead of the provider by the Coordinating Authorities, other competent authorities of the 
Member States and the Commission on all issues necessary for the receipt of, compliance 
with and enforcement of orders and decisions issued in relation to this Regulation, 
including detection orders, removal orders and, blocking orders and delisting orders. 


4. The provider shall provide its legal representative with the necessary powers and resources 
to cooperate with the Coordinating Authorities, other competent authorities of the Member 
States and the Commission and to comply with the orders and decisions referred to in 
paragraph 3. 


* The designated legal representative may be held liable for non-compliance with obligations 
of the provider under this Regulation, without prejudice to the liability and legal actions 
that could be initiated against the provider. 
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6. The provider shall notify the name, address, the electronic mail address and telephone 
number of its legal representative designated pursuant to paragraph | to the Coordinating 
Authority in the Member State where that legal representative resides or is established, and 
to the EU Centre. The provider or the legal representative Fhey-shall ensure that that 
information is up to date and publicly available. 


Te The designation of a legal representative within the Union pursuant to paragraph | shall 
not amount to an establishment in the Union. 
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CHAPTER II 


SUPERVISION, ENFORCEMENT AND COOPERATION 


Section 1 
Coordinating Authorities of the Member States-forchild sexual abuse issues 


Article 25? 


Coordinating Authorities ferehild-sexualebuseissues and other competent authorities 


Member States shall, by (Pate— #re-eighteen months from the date of entry into force of 
this Regulation}, designate one or more competent authorities as responsible for the 


application, and supervision and enforcement of this Regulation Ceempetentauthorities”} 


2. Where a Member State designates more than one competent authority, it shall 
appoint one of those competent authorities as Coordinating Authority. Where it 
designates only one competent authority, that competent authority shall be the 
Coordinating Authority. 


aiclLentereepentof this Recolor the Menber Shite coneerned ttess Member 


The Coordinating Authority shall in any event be responsible for ensuring coordination at 
national level in respect of these all matters relating to the application, supervision and 
enforcement of this Regulation and for contributing to the effective efficient and 
consistent application, supervision and enforcement of this Regulation throughout the 
Union. 


2 PCY comment: the new logic could be explained in a recital, as follows: 


“With a view to leaving Member States a degree of flexibility so as to implement solutions 
best adapted to their particular circumstances, whilst also ensuring the coordination at 
domestic level and cooperation at EU level needed to ensure the consistent, efficient and 
effective application of this Regulation, Member States should be able to designate several 
competent authorities yet be required in that case to appoint one of them as the Coordinating 
for which certain tasks are exclusively reserved under this Regulation. Therefore, each 
mention of competent authorities in this Regulation should be interpreted as referring to the 
relevant competent authorities designated by the Member States, including where relevant 


Co 


ordinating Authorities, while each mention of Coordinating Authorities should be 


interpreted as referring to Coordinating Authorities only, to the exclusion of any other 
competent authorities that the Member States may have designated.” 
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a: Where a Member State designates more than one competent authority #-additien_te—the 
Coordinatine Authority, it shall ensure that the respective tasks of those authorities aad-ef 
the-Coordinatine Authority including those of the Coordinating Authority, are clearly 
defined and that they cooperate closely and effectively when performing their tasks. Fhe 
Member State concerned shal communicate the nameof the other competent autherHies-as 


ge eae ) See none 


4. Within one week after the designation of the competent authorities, including the 
Coordinating Authorities and-other-competentautherties pursuanttie-paragrapht, Member 
States shall make publicly available, and communicate to the Commission and the EU 
Centre, the names of theit—Coerdinating Authority—and_ether—compentent those 
authorities as well as their respective tasks or sectors. They shall keep that information 
updated. 


Di Each-Member States shall ensurethat-acontact point is-desicnated_or establish a contact 
point within its ¢he-Coordinating Authority’s office to handle requests for clarification, 
feedback and other communications in relation to all matters related to the application and 
enforcement of this Regulationn—that-Member—State. Member States shall make the 
information on the contact point publicly available and communicate it to the EU Centre. 
They shall keep that information updated. 


6. Within two weeks after the designation of the Coordinating Authorities pursuant to 
paragraph 2, the EU Centre shall set up an online register listing the Coordinating 
Authorities and their contact points. The EU Centre shall regularly publish any 
modification thereto. 


ds Competent authorities ee ities may, where necessary for the 
performance of their tasks under this Regulation, request through the Coordinating 


Authority, the assistance of the EU Centre in carrying out those tasks, in particular, by 
requesting the EU Centre to: 


(a) provide certain information or technical expertise on matters covered by this 
Regulation; 


(b) assist in assessing, in accordance with Article 5(2), the risk assessment conducted or 
updated or the mitigation measures taken by a provider of hosting or interpersonal 
communication services under the jurisdiction of the Member State that designated 


the requesting competent authority Ceordinatine Authority; 


(c) provide opinion on verify the possible need for a competent authority to request 
cempetent national autherHties teissue the issuance of a detection order,-aremevat 
erder,orablockine-orderin respect of a service under the jurisdiction of the Member 


State thatdesienated that Cooerdinatine Authority; 


[(d) provide opinion on verify the effectiveness of a detection order er-a+remevalorder 
issucd upon the request of the requesting Coordinating Authoritys. |” 


23 PCY comment: to be revised pending further discussions on detection orders. 


7842/23 FL/ml 43 
ANNEX JALI LIMITE EN 


8. Hho EL Cenire-shel vide such assistance thee-oF¢ and in-accordance-with Hs 


9. 


Article 26 


Requirements for Goerdinating competent Authorities 
Member States shall ensure that the competent authorities matt Hties that 


they have designated carry out perform their tasks under this Regulation in an objective; 
impartial transparent-andtimely and non-discriminatory manner, while fully respecting 
the fundamental rights ef-all_parties—affected*>. Member States shall ensure that their 
Coordinatine Authorities those authorities have adequate technical, financial and human 
resources to carry out their tasks. 


Those authorities inati ities shall not seek or take instructions 


from any other body in relation to carrying out their tasks under this Regulation”. 


(54 —_haweea statis enabliae thentte tobe eb and path aber ent ett thet: 


peaiaeae id 


24 
25 
26 


PCY comment: moved to Art 43(5)(b) on the EU Centre. 
PCY comment: wording copied from Art. 13(2) of the TCO Regulation. 
PCY comment: 


1) A recital could specify that competent authorities can be any body or entity fulfilling at 
least the independence requirements enshrined in Article 26(1) of the proposal, except for 
judicial authorities, as follows: “Member States should be free to designate any body or entity 
fulfilling at least the independence requirements established in Article 26(1) as competent 
authority for the purpose of this Regulation, with the exception of national judicial 
authorities.” 


2) To address some delegations’ concerns that competent authorities would be getting 
“instructions” from judicial authorities, a recital could be added, as follows: “In order to 
ensure that the competent authorities designated under this Regulation carry out their tasks 
under this Regulation in an objective, adequate and responsible manner, in compliance with 
the fundamental rights guaranteed under the Charter and without any undue interference, 
certain requirements in this respect should be provided for. Those requirements should not be 
interpreted as precluding judicial review of the activities of competent authorities in 
accordance with EU law or with national law in accordance with EU law.” 
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(¢}— are free from any externalinfhience whether direct or indirect: 


abuse,-other than_theirtasks under this Regulation. 


Paragraph 2-1 shall not prevent supervision of the Ceerdinatine competent aAuthorities in 
accordance with national constitutional law,tethe-extent that such _supervision _does not 


aHeetthentidependeneeia teqtirectinde: this Ree tatiga. 


The Coordinating Authorties_and-ether competent authorities shall ensure that their 
relevant members—of staff have the required qualifications, experience, tmtegrity and 


technical skills to perferm carry out the application, supervision and enforcement 
under this Regulation duties. 


The management and other staff of the Coordinating Authorities shall, in accordance with 
Union or national law, be subject to a duty of professional secrecy both during and after 
their term of office, with regard to any confidential information which has come to their 
knowledge in the course of the performance of their tasks. Member States shall ensure that 
the management and other staff are subject to rules guaranteeing that they can carry out 
their tasks in an objective, impartial and independent manner, in particular as regards their 
appointment, dismissal, remuneration and career prospects. 


Section 2 
Powers of competent authorities the Coordinating Authorities of Member States 


Article 27°” 
Investigatory and enforcement powers 


Where needed in order to fet-carrying out their tasks under this Regulation, competent 
authorities Coordinating Authorities or—ether_cempetent_authorities shall have the 


following powers of investigation, in respect of conduct by providers of relevant 
information society services falling within the competence undertheurisdiction of the 


their Member State that desienated+them: 


27 


PCY comment: copied word for word from Art. 51 of the DSA as a baseline for further 
discussions. Differences include that (i) both the Coordinating and competent authorities are 
included; (ii) this text speaks about “user”, not “the recipient of a service” and (iii) in point 3b 
below the wording “or the infringement results in the regular and structural facilitation of 
child sexual abuse offences” has been maintained. The restruturing of Articles 27 to 30 to 
ensure alignement with DSA has lead to the fact that some cross-references need to be 
corrected. This will be done once the text is stable. For the delegations’ ease, a clean 
version of Articles 27-30 is in annex. 
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(a) 


(b) 


(c) 


(d) 


the power to require those providers, as well as any other persons acting for purposes 
related to their trade, business, craft or profession that may reasonably be aware of 
information relating to a suspected infringement of this Regulation, to provide such 


information without undue delay-within-a+easonable time-period; 


the power to carry out, or to request a judicial authority to order, on-site 
inspections of any premises that those providers or the-other-those persons referred 
te4n-poeint{a} use for purposes related to their trade, business, craft or profession, or 
to request other public authorities to do so, in order to examine, seize, take or obtain 
copies of information relating to a suspected infringement ef this Regulation in any 
form, irrespective of the storage medium; 


the power to ask any member of staff or representative of those providers or the ether 
those persons to give explanations in respect of any information relating to a 


suspected infringement ofthis-Regulation—and to record the answers by any 
technical means; 


the power to request information, including to assess whether the measures taken to 
execute a detection order, removal order,—er blocking order or delisting order 
comply with the requirements of this Regulation. 


2.4— Where needed for carrying out their tasks under this Regulation, competent authorities 
Coordinating Authorities or—oether—competent—autherities shall have the following 


enforcement powers, in respect of providers of relevant information society services 
falling within the competence underthe—purisdiction of the their Member State that 


desienated+them: 


(a) 


(c) 


the power to accept the commitments offered by those providers in relation to their 
compliance with this Regulation and to make those commitments binding; 


the power to order the cessation of infringements ef+this-Regulatien and, where 
appropriate, to impose remedies proportionate to the infringement and necessary to 
bring the infringement effectively to an end or to request a judicial authority in 
their Member-States to do so; 


the power to impose fines, or request a judicial authority in their Member State to do 
so, in accordance with Article 35 for failure to comply with infringements—of this 
Regulation, including nen-complanee—with any of the investigative orders issued 
pursuant to paragraph 1 of this Article 27 andte-peint(b) othis-paragraph; 
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(d) the power to impose a periodic penalty payment, or to request a judicial authority 
to do so, in accordance with Article 35 to ensure that an infringement ef+this 
Regulation is terminated in compliance with an order issued pursuant to point (b) of 
this subparagraph or for failure to comply with any of the orders issued pursuant to 
paragraph 1 of this Article. 27+ and+te-peint(b) ofthis-paragraph; 


(e) the power to adopt interim measures or to request the competent national judicial 
authority to do so, to avoid the risk of serious harm. 


3. As regards the first subparagraph +, points (c) and (d), competent authorities 
Coordinating Authorities or-other-competent-authorities shall also have the enforcement 
powers set out in those points-alse-in respect of the other persons referred to in paragraph 
1Article27, for failure to comply with any of the orders issued to them pursuant to that 
paragraph Article. 4. They shall only exercise those enforcement powers after having 
provided those other persons in good time with all relevant information relating to such 
orders, including the applicable t#ne-period, the fines or periodic payments that may be 
imposed for failure to comply and redress-the possibilities for redress. 


Artiele29 
(dditional.enkk 


3.4— Where needed for carrying out their tasks under this Regulation, competent authorities 


Coordinating Authorities or—ether_competent_autheorities shall have—the—additional 


enforcement powers referred tein paragraph 2, in respect of providers of relevant 
information society services falling within the competence underthe jurisdiction of their 


Member State, where that designated them,provided that: 


(a}—all other powers pursuant to this Articles27and2$8-to bring about the cessation of an 
infringement ef this Regulation have been exhausted; 


(b)—and the infringement has not been remedied or is continuing and is -persistss 


(e}—_ the infringement causes-causing serious harm which cannot be avoided through the 


exercise of other powers available under Union or national law, also have the power 
to take the following measures: 


(a) to require the management body of the providers, without undue delay, to examine 
the situation, within-a-reasenable time-period and te: 
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4}— adopt and submit an action plan setting out the necessary measures to terminate 
the infringement; 


44)— ensure that the provider takes those measures; and 


4#4—report on the measures taken; 


(b) where the Coordinating Authority competent authorities or—ether_competent 


authorities consider that a provider of relevant information society services has 
not sufficiently complied with the requirements of point (a), that the 
infringement has not been remedied or is continuing and is causing serious 
harm, and that that infringement entails a criminal offence involving a threat to 
the life or safety of persons or the infringement results in the regular and 
structural facilitation of child sexual abuse offences, to request that the competent 
judicial authority or other independent administrative authority of its the Member 
State that designated the Coordinating Authority te order the temporary restriction of 
access of users of the service concerned by the infringement or, only where that is 
not technically feasible, to the online interface of the provider on which the 


infringement takes place. -=wherethe-Cooerdinatins Authority considers that: 
4)—_ the preside has tetsutticenthconelied ah the peeeipenents of Boh HE 


44 —hesteisentent persists aie eae Se tioes Hae 


aii ee | facilitati € child 
abuse-offences. 


3.——The Coordinatins Authority er ether competent authorities shall, prior to submitting the 
request referred to in this paragraph 2, point (b), invite interested parties to submit written 
observations within a period that shall not be less than two weeks, describing the 
measures that it intends to request and identifying the intended addressee or 
addressees thereof. The provider, the intended addressee or addressees and any other 
third party demonstrating a legitimate interest shall be entitled to participate in the 
proceedings before the competent judicial authority or other independent 
administrative authority. 


ee ee 


“eee tier to serbatatern obsereations shat 
2 eee ere 
t5+—ident Bethe dtended adidtessce ciddresseces tered £ 
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4.———_Any measure ordered upen—the-+request referred toin—paragraph2,_peint{b}, shall be 


proportionate to the nature, gravity, recurrence and duration of the infringement, without 
unduly restricting access to lawful information by users of the service concerned. 


The temporary-restriction of access shall be apph-for a period of four weeks, subject to the 
possibility for the competent judicial authority or other independent administrative 
authority of the Member State, in its order, to allow the Coerdinatine Authority er ether 
competent authorities, including the Coordinating Authorities, to extend that period 
for further periods of the same lengths, subject to a maximum number of extensions set by 
a that judicial authority or other independent administrative authority. 


The Cooerdinatine Authority er other competent authorities, including the Coordinating 
Authorities, referred to in the previous subparagraph shall only extend the period 


where-t-eonsiders, having regard to the rights and leg#t#mate-interests of all parties affected 
by the that restriction and all relevant facts-and circumstances, including any information 
that the provider, the addressee or addressees and any other third party that demonstrated a 
legitimate interest may provide to it, it considers that both of the following conditions 
have been met: 


(a) the provider has failed to take the necessary measures to terminate the infringement; 


(b) the temporary restriction does not unduly restrict access to lawful information by 
users of the service, having regard to the number of users affected and whether any 
adequate and readily accessible alternatives exist. 


Where the Coordinatine—Authorty er ether competent authority, including the 
Coordinating Authority, considers that the conditions set out in the fourth 


subparagraph, points (a) and (b) these-twe—cenditions have been met but it cannot 
further extend the period pursuant to the fourth seeend-subparagraph, it shall submit a new 
request to the competent judicial authority or other independent administrative 
authority, as referred to in the first subparagraph, point (b). 


4. 1—The measures taken by the Ceerdinatine Authorities_-or-other competent authorities in 


the exercise of their iwvestigatery-and-enfercementpowers listed in paragraphs 1, 2 and 
3 referred toin Articles 27, 28 and 29 shall be effective, dissuasive and proportionate, 


having regard, in particular, to the nature, gravity, recurrence and duration of the 
infringement ef this Regulatien-or suspected infringement to which those measures relate, 
as well as the economic, technical and operational capacity of the provider of relevant 
information society services concerned; where relevant-appHeable. 
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5.2.——Member States shall lay down specific rules and procedures for the exercise of the 
powers pursuant to paragraphs 1, 2 and 3 and shall ensure that any exercise of those 
the ivestigateryand enforcement powers referred ton Articles 27, 28 and 20 is subject to 
adequate safeguards laid down in the applicable national law in compliance with the 
Charter and with the general principles of Union law te-respectthe fundamental iehts 
efal-parties-affected. In particular, those measures shall only be taken in accordance with 
the right to respect for private life and the rights of defence, including the rights to be heard 
and of access to the file, and subject to the right to an effective judicial remedy of all 
parties affected parties. 


Article 31 


Searches to verify compliance 


The competent authorities Coordinating Authorities or-other-competent-_authorities shall have 


the power to carry out searches on publicly accessible material on hosting services to detect the 
dissemination of known or new child sexual abuse material, using the indicators contained in the 
databases referred to in Article 44(1), points (a) and (b), where necessary to verify whether the 
providers of hosting services under the jurisdiction of the Member State that designated the 
Coordinating Authorities comply with their obligations under this Regulation. 


Artiele32 
Notifieti c] hild a ‘al 


Fhetreqrest shalt cleath sete ide-teation deta ofthe Coordinate Atthortanakie te 
DR REDE? Shah, tee RT: ee 


ag tho Seasons fords Akt Wii cecuost- shall alse -sleesls ctte hae 55 forthe-crowider’s 


vohintary consideration ”8 


28 PCY comment: It is the view of the PCY that this power can be explained and described in a 


recital that builds on recital 40 of the TCO Regulation and Article 16 DSA. The recital below 
clarifies that competent authorities can make use of notice and action mechanisms and be 


appointed as trusted flaggers: “Nothing in this Regulation precludes competent authorities 
designated therein to submit notices to providers of hosting services on the basis of 
notice and action mechanisms pursuant to Article 16 of Regulation (EU) 2022/2065 
(Digital Services Act) to notify them of the presence of one or more specific items of 
known child sexual abuse material, nor to request the status of trusted flagger under the 
conditions established under Article 22 of that Regulation. ” 
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Section 3 
Other provisions on enforcement 
Article 33 
Jurisdiction 


1. The Member State in which the main establishment of the provider of relevant information 
society services is located shall have jurisdiction for the purposes of this Regulation. 


2: A provider of relevant information society services which does not have an establishment 
in the Union shall be deemed to be under the jurisdiction of the Member State where its 
legal representative resides or is established. 


Where a provider failed to appoint a legal representative in accordance with Article 24, all 
Member States shall have jurisdiction. Where a Member State decides to exercise 
jurisdiction under this subparagraph, it shall inform all other Member States and ensure 
that the principle of ne bis in idem is respected. 


Article 3479 


Right efttsers-of the-service to lodge a complaint 


1. Users and any body, organisation or association mandated to exercise the rights 
conferred by this Regulation on their behalf shall have the right to lodge a complaint 
against providers of relevant information society services alleging an infringement of 
this Regulation affectingthem agatist-providers_of relevant information society services 
with the Coordinating Authority destg¢nated-by in the Member State where the user is 
located resides-or is-established. 


pis Coordinating Authorities shall provide child-friendly mechanisms to submit a complaint 
under this Article and adopt a child-sensitive approach when handling complaints 
submitted by children, taking due account of the child's age, maturity, views, needs and 
concerns. 


3. The Coordinating Authority reeetine the-complaint shall assess the complaint and, where 
appropriate, transmit it to the Coordinating Authority of establishment, accompanied, 


where appropriate, by its reasoning an-epinion. 


Where the complaint falls under the responsibility of another competent authority in its 
Member State, that-designated the Coordinating Authority receiving the complaint,that 


Coordinating Authority shall transmit it to that ethercempetent authority. 


29 PCY comment: copied word for word from Art. 53 of the DSA. 
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During these proceedings, both parties shall have the right to be heard and receive 
appropriate information about the status of the complaint, in accordance with 
national law. 


Article 34b°° 
Representation 


Without prejudice to Directive (EU) 2020/1828 or to any other type of representation 
under national law, users of relevant information society services shall at least have 
the right to mandate a body, organisation or association to exercise the rights 
conferred by this Regulation on their behalf, provided the body, organisation or 
association meets all of the following conditions: 


(a) it operates on a non-profit basis; 
(b) it has been properly constituted in accordance with the law of a Member State; 


(c) its statutory objectives include a legitimate interest in ensuring that this 
Regulation is complied with. 


Providers of relevant information society services shall take the necessary technical 
and organisational measures to ensure that complaints submitted by bodies, 
organisations or associations referred to in paragraph 1 of this Article on behalf of 
recipients of the service through the mechanisms referred to in Article xx are 
processed and decided upon with priority and without undue delay. 


Article 3534 
Penalties*” 


Member States shall lay down the rules on penalties applicable to infringements of the 
obligations pursuant to Chapters II and V of this Regulation by providers of relevant 
information society services within their competence undertheitjurisdiction and shall 
take all the necessary measures to ensure that they are implemented in accordance with 
Article 27. 


Fhe-pPenalties shall be effective, proportionate and dissuasive. Member States shall, by 
[Date of application of this Regulation], notify the Commission of those rules and of those 
measures and shall notify it, without delay, of any subsequent amendments affecting them. 


30 PCY comment: copied word for word from Art. 86 of the DSA. To be discussed in relation to 
Articles 18(3) and 34. 


31 


PCY comment: copied word for word from Art. 52 of the DSA (except paragraph 4 that is 


taken from the TCO Regulation). 


32 


PCY comment: this should be understood as administrative sanctions, not criminal sanctions, 


i.e. penalties (TCO and DSA use the wording “penalties” when these are in fact 
administrative sanctions). A recital should be included to clarify this issue. 
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34. 


45. 


Member States shall ensure that the maximum amount of fines that may be penalties 
imposed for an a failure to comply with an obligation laid down in Chapters II and V 
infrmeementof this Regulation shall be not exceed 6 % of the annual worldwide income 
eretebal turnover of the providers concerned in the preceding financial business-year-ef 
the-provider. 3-Member States shall ensure that the maximum amount of the fine that 
may be imposed Penalties for the supply of incorrect, incomplete or misleading 
information, failure to reply or rectify incorrect, incomplete or misleading information oF 
and failure to submit to an e”-s#e inspection shall be not exceed 1% of the annual income 
or worldwide glebal turnover of the preceding-business—year-ofthe provider or the-other 
person concerned in the preceeding financial year-referredte+n Article 27. 


Member States shall ensure that the maximum amount of a periodic penalty payment shall 
be not exceed 5 % of the average daily worldwide glebalturnover or income of the 
provider erthe-ether-person_referred tein Article 27 in the preceding financial year per 
day, calculated from the date specified in the decision concerned. 


Member States shall ensure that the competent authorities, when deciding whether to 
impose a penalty and when determining the type and level of penalty, account is taken of 
all relevant circumstances, including: 


(a) the nature, gravity and duration of the infringement; 
(b) whether the infringement was intentional or negligent; 
(c) afyprevious infringements by the provider or the other person; 


(d) the financial strength of the provider-orthe-other person; 


(e) the level of cooperation of the provider with the competent authorities orthe-other 
person; 


(f) the nature and size of the provider-erthe-other-persen, in particular whether it is a 
micro, small or medium-sized enterprise; 


(g) the degree of fault of the provider or other person, taking into account the technical 
and organisational measures taken by the provider it-to comply with this Regulation. 
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33 


Section 4 
Cooperation 
Article 36 3 
Identification and submission of online child sexual abuse 


Coordinating Authorities shall submit to the EU Centre, without without undue delay and 
through the system established in accordance with Article 39(2): 


(a) aioe items of material and transcripts of conversations that competent 
ae independent-administrative-autherities of a Member State have identified, after 
a diligent assessment, as constituting child sexual abuse material or the solicitation of 
children, as applicable, for the EU Centre to generate indicators in accordance with 
Article 44(3); 


(b) exact uniform resource locators indicating the electronic location of the 


information piesa aii cDaa Seen that competent authorities Coordinating 


Authorities orthat competent judicial authorties_or other independent administrative 
authorities of a Member State have identified, after a diligent assessment, as 


constituting child sexual abuse material, hosted by providers of hosting services not 
offering services in the Union, that cannot be removed due to those providers’ refusal 
to remove or disable access thereto and to the lack of cooperation by the competent 
authorities of the third country having jurisdiction, for the EU Centre to compile the 
list of uniform resource locators in accordance with Article 44(3). 


Member States shall take the necessary measures to ensure that the Coordinating 
Authorities that they designated receive, without undue delay, the material identified as 
child sexual abuse material, the transcripts of conversations identified as the solicitation of 
children, and the uniform resource locators, identified by a l_competent Authority 2 a 


Coordinatine Mma for submission to the EU Geile in cordance with fhe first 
subparagraph. 


PCY comment: the LEWP should continue working on this Article and return to it once more 
clarity is reached on the detection and blocking orders. Meanwhile the Commission has 
provided a proposal for a new recital to make clear that law enforcement can be involved in 
the process to determine the illegality of the content, under judicial supervision, as follows: 
“Member States should set up expedited procedures for the diligent assessment of 
suspected child sexual abuse, so as to allow for the swift submission to the EU Centre of 
the specific items of material, transcripts of conversations and uniform resource locators 
concerned upon the reliable establishment of the illegality. With a view to facilitating 
and expediting such assessment, competent authorities may assist the competent judicial 


authorities or independent administrative authorities responsible for such an 
assessment.” 
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Upon the request of the EU Centre where necessary to ensure that the data contained in the 
databases referred to in Article 44(1) are complete, accurate and up-to-date, Coordinating 
Authorities shall verify or provide clarifications or additional information as to whether the 
conditions of paragraph 1, points (a) and (b) have been and, where relevant, continue to be 
met, in respect of a given submission to the EU Centre in accordance with that paragraph. 


Member States shall ensure that, where their law enforcement authorities receive a report 
of the dissemination of new child sexual abuse material or of the solicitation of children 
forwarded to them by the EU Centre in accordance with Article 48(3), a diligent 
assessment is conducted in accordance with paragraph 1 and, if the material or 
conversation is identified as constituting child sexual abuse material or as the solicitation 
of children, the Coordinating Authority submits the material to the EU Centre, in 
accordance with that paragraph, within one month from the date of reception of the report 
or, where the assessment is particularly complex, two months from that date. 


They shall also ensure that, where the diligent assessment indicates that the material does 
not constitute child sexual abuse material or the solicitation of children, the Coordinating 
Authority is informed of that outcome and subsequently informs the EU Centre thereof, 
within the time periods specified in the first subparagraph. 


Article 3774 
Cross-border cooperation among Coordinating Authorities 


Where a Coordinating Authority that is not the Coordinating Authority of establishment 
has reasons to suspect that a provider of relevant information society services infringed this 
Regulation in a manner negatively affecting the users of the service in the Member 
State of that Coordinating Authority, it may shal-request the Coordinating Authority of 
establishment to assess the matter and to take the necessary investigatory and enforcement 
measures to ensure compliance with this Regulation. 


dhe Reedtaten ha ae 


atleast three Mempbe 


seciety_servicesHit ivehine 


Faater and tke the Hees sc HES HHO and enfercement—measures—to—ensure 
1 4, 1S Reculation. 


34 PCY comment: copied word for word from Art. 58 of the DSA. 
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2 Fhe A request errecommendation pursuant referred to in paragraph | shall be duly 
reasoned and at least indicate: 


(a) the point of contact of the provider as set out in Article 23; 


(b) a description of the relevant facts, the provisions of this Regulation concerned and 
the reasons why the Coordinating Authority that sent the requesterthe-Commission 
suspects, that the provider infringed this Regulation including the description of the 
negative effects of the alleged infringement; 


(c) any other information that the Coordinating Authority that sent the request—or+the 
Commission, considers relevant, including, where appropriate, information gathered 
on its own initiative and or suggestions for specific investigatory or enforcement 
measures to be taken, including interim measures. 


ex The Coordinating Authority of establishment shall take utmost account of the requests 

pursuant to paragraph 1 of this Article assess the a a. gah cleans taking into 

: men p sraph—t+. Where it 

considers ne it has eutnGicnt penn to asses_the Me occt pence erte-act 

upon the request er-reeemmendation and has reasons to consider that the Coordinating 

Authority that sent the request-erthe-Commissien, could provide additional information, it 

may request such information. The time period laid down in paragraph 4 shall be 
suspended until that additional information is provided. 


4. The Coordinating Authority of establishment shall, without undue delay and in any event 
not later than two months following receipt of the request er+recommendation pursuant 
referred_to in—paragraph 1, communicate to the Coordinating Authority that sent the 
Fequcsinoethe Comeauioe: the exuteome-ofits assessment of the suspected infringement; 
erthat-ef any—other_competent_authority_pursuant to_national Jaw —where+elevant, and; 
where-appHeable, an explanation of the investigatory or enforcement measures taken or 
envisaged in relation thereto to ensure compliance with this Regulation. 
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Article 38° 
Joint investigations 


Coordinating Authorities may participate in joint investigations, which may be coordinated 
with the support of the EU Centre, of matters covered by this Regulation, concerning 
providers of relevant information society services that offer their services in several 
Member States. 


Such joint investigations are without prejudice to the tasks and powers of the participating 
Coordinating Authorities and the requirements applicable to the performance of those tasks 
and exercise of those powers provided for in this Regulation. 


The participating Coordinating Authorities shall make the results of the joint investigations 
available to other Coordinating Authorities, the Commission and the EU Centre, through 
the system established in accordance with Article 39(2), for the fulfilment of their 
respective tasks under this Regulation. 


Article 38a°*° 
Mutual assistance 


The Coordinating Authorities, the competent authorities of the Member States and the 
EU Centre Digital-Services—Coordinators—and_the—Conunission-Shall cooperate closely 
and provide each other with mutual assistance in order to apply this Regulation in a 
consistent and efficient manner. Mutual assistance shall include, in particular, 
exchange of information in accordance with this Article and the duty of the Digital 
ee Shiite ped to ete all 
Coordinating Authorities Digt 4 the Bente 4 
the-Commission about the Prarind of an jnivestivation aad the intention to take a final 
decision, including its assessment, in respect of a specific provider of a relevant 


information society intermediary service. 


35 


36 


PCY comment: The PCY notes that the elements of the Article can be found in Article 58 of 
the DSA. The PCY observes that a number of delegations have requested clarifications about 
what is meant with joint investigations, a concept that is close also to law enforcement and 
judicial cooperation. This could be clarified in a recital, as follows: “Joint investigations” 


under Article 38 should be interpreted as formal inquiries by Coordinating Authorities 
concerning the compliance of the provider of relevant information society services with 
the obligations arising from this Regulation. Insofar as the penalties for infringements of 
those obligations provided for by the Member State concerned pursuant to this 
Regulation are not criminal in nature, “joint investigations” under Article 38 should not 


be interpreted as criminal investigations, which are usually conducted by law 
enforcement authorities under national law.” 


Copied from Article 57 of the DSA (changes vis-a-vis the DSA in italics). 


7842/23 FL/ml 57 
ANNEX JALI LIMITE EN 


2. For the purpose of an investigation, a Coordinating Authority the Digital-Services 


Coordinator-of-establishnrent may request a Coordinating Authority in another Member 
State ether—Digital_Services—Coordinators to provide specific information in their 
possession as regards a specific provider of relevant information society intermediary 
services or to exercise their investigative powers referred to in Article 27 544 with 
regard to specific information located in their Member State. Where appropriate, the 


Coordinating Authority Digital Services-Coordinater receiving the request may involve 
other competent authorities or other public authorities of the Member State in 


question. 


3. The Coordinating Authority Digital—Services—Coordinatoer receiving the request 


pursuant to paragraph 2 shall comply with such request and inform the requesting 


Coordinating Authority Digital-Services-Coordinater_of-establishnent about the action 


taken, without undue delay and no later than two months after its receipt, unless: 


(a) the scope or the subject matter of the request is not sufficiently specified, 
justified or proportionate in view of the investigative purposes; or 


(b) neither the requested Coordinating Authority Digital-Serviee—Coeordinater nor 


other competent authority or other public authority of that Member State is in 
possession of the requested information nor can have access to it; or 


(c) the request cannot be complied with without infringing Union or national law. 


The Digital_Services-Coordinater Coordinating Authority receiving the request shall 


justify its refusal by submitting a reasoned reply, within the period set out in the first 
subparagraph. 


Article 39 


GeneraleCooperation, coordination and information-sharing system 


1. Competent authorities nati Ht a sincerch, pooper with ce 
other, eth +H ; j 


Authority, the Comission, the EU Cente aid Bther relevant Union agencies, sdelnaiiie 
Europol, to facilitate the performance of their respective tasks under this Regulation and to 
ensure its effective, efficient and consistent application and enforcement,_without 


prejudice _to the _possibilitty for Member States to provide for cooperation 
mechanisms and regular exchanges of views between the competent authorities where 
relevant for the performance of their respective tasks in accordance with this 
Regulation. 


la. The authorities and agencies referred to in paragraph 1 may, including with the 
support from the EU Centre, coordinate their work under this Regulation with a view 
to avoiding interference with criminal investigations in different Member States and 
to avoiding duplication of efforts. 
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The EU Centre shall establish and maintain one or more reliable and secure information 
sharing systems supporting communications between Coordinating Authorities, the 
Commission, the EU Centre, other relevant Union agencies and providers of relevant 
information society services. 


The Coordinating Authorities, the Commission, the EU Centre, other relevant Union 
agencies and providers of relevant information society services shall use the information- 
sharing systems referred to in paragraph 2 for all relevant communications pursuant to this 
Regulation. 


The Commission shall adopt implementing acts laying down the practical and operational 
arrangements for the functioning of the information-sharing systems referred to in 
paragraph 2 and their interoperability with other relevant systems. Those implementing 
acts shall be adopted in accordance with the advisory procedure referred to in Article 87. 
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CHAPTERIV 


EU CENTRE TO PREVENT AND COMBAT CHILD SEXUAL ABUSE 
Section 1 
Principles 
Article 40 
Establishment and scope of action of the EU Centre 


1. A European Union Agency to prevent and combat child sexual abuse, the EU Centre on 
Child Sexual Abuse, is established. 


2 The EU Centre shall contribute to the achievement of the objective of this Regulation by 
supporting and facilitating the implementation of its provisions concerning the detection, 
reporting, removal or disabling of access to, and blocking of online child sexual abuse and 
gather and share information and expertise and facilitate cooperation between relevant 
public and private parties in connection to the prevention and combating of child sexual 
abuse, in particular online. 


Article 41 
Legal status 
1. The EU Centre shall be a body of the Union with legal personality. 
2 In each of the Member States the EU Centre shall enjoy the most extensive legal capacity 


accorded to legal persons under their laws. It may, in particular, acquire and dispose of 
movable and immovable property and be party to legal proceedings. 


3; The EU Centre shall be represented by its Executive Director. 


Article 42 
Seat 


The seat of the EU Centre shall be The Hague, The Netherlands. 
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Section 2 


Tasks 
Article 43 
Tasks of the EU Centre 
The EU Centre shall: 
(1) facilitate the risk assessment process referred to in Section 1 of Chapter II, by: 


(a) supporting the Commission in the preparation of the guidelines referred to in Article 
3(8), Article 4(5), Article 6(4) and Article 11, including by collecting and providing 
relevant information, expertise and best practices, taking into account advice from 
the Technology Committee referred to in Article 66; 


(b) upon request from a provider of relevant information services, providing an analysis 
of anonymised data samples for the purpose referred to in Article 3(3); 


(2) facilitate the detection process referred to in Section 2 of Chapter II, by: 


(a) providing the opinions on intended detection orders referred to in Article 7(3), first 
subparagraph, point (d); 


(b) maintaining and operating the databases of indicators referred to in Article 44; 
(c) giving providers of hosting services and providers of interpersonal communications 
services that received a detection order access to the relevant databases of indicators 


in accordance with Article 46; 


(d) making technologies available to providers for the execution of detection orders 
issued to them, in accordance with Article 50(1); 


(3) facilitate the reporting process referred to in Section 3 of Chapter II, by: 
(a) maintaining and operating the database of reports referred to in Article 45; 


(b) assessing, processing and, where necessary, forwarding the reports and providing 
feedback thereon in accordance with Article 48; 


(4) facilitate the removal process referred to in Section 4 of Chapter II and the other processes 
referred to in Section 5, 5a and 6 of that Chapter, by: 


(a) receiving the removal orders transmitted to it pursuant to Article 14(4) in order to 
fulfil the verification function referred to in Article 49(1); 
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(aa) receiving decisions on a cross-border removal order transmitted to it pursuant 
to Article 14a(5); 


ab) receiving copies of final removal orders and thereto connected information 


transmitted to it pursuant to Article 15(2); 


(c) receiving and processing the blocking orders transmitted to it pursuant to Article 
17(3); 


ca) receiving copies of final blocking orders and thereto connected information 


transmitted to it pursuant to Article 18(2); 
(cb) receiving the delisting orders transmitted to it pursuant to Article 18b(2); 


cc) receiving copies of final delisting orders and thereto connected information 


transmitted to it pursuant to Article 18c(3); 


(d) providing information and support to victims in accordance with Articles 20 and 21; 


(e) maintaining up-to-date records of contact points and legal representatives of 
providers of relevant information society services as provided in accordance with 
Article 23(2) and Article 24(6); 


(5) support the competent authorities, including the Coordinating Authorities, and the 
Commission in the performance of their tasks under this Regulation and facilitate 
cooperation, coordination and communication in connection to matters covered by this 
Regulation, by: 


(a) creating and maintaining an online register listing the Coordinating Authorities and 
their contact points referred to in Article 25(6); 


(b) providing assistance to the Coordinating Authorities free_of charge and_in 


accordance with its tasks and obligations under this Regulation as-previded_fer 
: > 


(c) assisting the Commission, upon its request, in connection to its tasks under the 
cooperation mechanism referred to in Article 37; 


(d) creating, maintaining and operating the information-sharing system referred to in 
Article 39; 
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(c) 


(f) 


assisting the Commission in the preparation of the delegated and implementing acts 
and the guidelines that the Commission adopts under this Regulation; 


providing information to Coordinating Authorities, upon their request or on its own 
initiative, relevant for the performance of their tasks under this Regulation, including 
by informing the Coordinating Authority of establishment of potential infringements 
identified in the performance of the EU Centre’s other tasks; 


(6) facilitate the generation and sharing of knowledge with other Union institutions, bodies, 
offices and agencies, competent authorities including Coordinating Authorities, or other 
relevant authorities of the Member States to contribute to the achievement of the objective 
of this Regulation, by: 

(a) collecting, recording, analysing and providing information, providing analysis based 
on anonymised and non-personal data gathering, and providing expertise on matters 
regarding the prevention and combating of online child sexual abuse, in accordance 
with Article 51; 

(b) supporting the development and dissemination of research and expertise on those 
matters and on assistance to victims, including by serving as a hub of expertise to 
support evidence-based policy; 

(c) drawing up the annual reports referred to in Article 84. 

Article 44 
Databases of indicators 

1. The EU Centre shall create, maintain and operate databases of the following three types of 
indicators of online child sexual abuse: 

(a) indicators to detect the dissemination of child sexual abuse material previously 
detected and identified as constituting child sexual abuse material in accordance with 
Article 36(1); 

(b) indicators to detect the dissemination of child sexual abuse material not previously 
detected and identified as constituting child sexual abuse material in accordance with 
Article 36(1); 

(c) indicators to detect the solicitation of children. 

Di The databases of indicators shall solely contain: 

(a) relevant indicators, consisting of digital identifiers to be used to detect the 
dissemination of known or new child sexual abuse material or the solicitation of 
children, as applicable, on hosting services and interpersonal communications 
services, generated by the EU Centre in accordance with paragraph 3; 
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(b) as regards paragraph 1, point (a), the relevant indicators shall include a list of 
uniform resource locators compiled by the EU Centre in accordance with paragraph 
3; 


(c) the necessary additional information to facilitate the use of the indicators in 
accordance with this Regulation, including identifiers allowing for a distinction 
between images, videos and, where relevant, other types of material for the detection 
of the dissemination of known and new child sexual abuse material and language 
identifiers for the detection of solicitation of children. 


oe The EU Centre shall generate the indicators referred to in paragraph 2, point (a), solely on 
the basis of the child sexual abuse material and the solicitation of children identified as 


such by the Coerdinatine—Autherties competent authorities of the Member States, 
submitted to it by the Coordinating Authorities pursuant to Article 36(1), point (a). 


The EU Centre shall compile the list of uniform resource locators referred to in paragraph 
2, point (b), solely on the basis of the uniform resource locators submitted to it pursuant to 
Article 36(1), point (b). 


4. The EU Centre shall keep records of the submissions and of the process applied to generate 
the indicators and compile the list referred to in the first and second subparagraphs. It shall 
keep those records for as long as the indicators, including the uniform resource locators, to 
which they correspond are contained in the databases of indicators referred to in paragraph 


1. 
Article 45 
Database of reports 
1. The EU Centre shall create, maintain and operate a database for the reports submitted to it 


by providers of hosting services and providers of interpersonal communications services in 
accordance with Article 12(1) and assessed and processed in accordance with Article 48. 


2 The database of reports shall contain the following information: 
(a) the report; 


(b) where the EU Centre considered the report manifestly unfounded, the reasons and the 
date and time of informing the provider in accordance with Article 48(2); 


(c) where the EU Centre forwarded the report in accordance with Article 48(3), the date 
and time of such forwarding and the name of the competent law enforcement 
authority or authorities to which it forwarded the report or, where applicable, 
information on the reasons for forwarding the report solely to Europol for further 
analysis; 
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(d) where applicable, information on the requests for and provision of additional 
information referred to in Article 48(5); 


(e) where available, information indicating that the provider that submitted a report 
concerning the dissemination of known or new child sexual abuse material removed 
or disabled access to the material; 


(f) where applicable, information on the EU Centre’s request to the Coordinating 
Authority competent authority of establishment to issue a removal order pursuant to 
Article 14 in relation to the item or items of child sexual abuse material to which the 
report relates; 


(g) relevant indicators and ancillary tags associated with the reported potential child 
sexual abuse material. 


Article 46 
Access, accuracy and security 


1. Subject to paragraphs 2 and 3, solely EU Centre staff and auditors duly authorised by the 
Executive Director shall have access to and be entitled to process the data contained in the 
databases referred to in Articles 44 and 45. 


2: The EU Centre shall give providers of hosting services, providers of interpersonal 
communications services, and providers of internet access services and_ providers of 
online search engines access to the databases of indicators referred to in Article 44, where 
and to the extent necessary for them to execute the detection or blocking orders that they 
received in accordance with Articles 7 or 16. It shall take measures to ensure that such 
access remains limited to what is strictly necessary for the period of application of the 
detection or blocking orders concerned and that such access does not in any way endanger 
the proper operation of those databases and the accuracy and security of the data contained 
therein. 


3: The EU Centre shall give Coordinating Authorities competent authorities access to the 
databases of indicators referred to in Article 44 where and to the extent necessary for the 


performance of their tasks under this Regulation. 


4. The EU Centre shall give Europol and the competent law enforcement authorities of the 
Member States access to the databases of indicators referred to in Article 44 where and to 
the extent necessary for the performance of their tasks of investigating suspected child 
sexual abuse offences. 


5. The EU Centre shall give Europol access to the databases of reports referred to in Article 
45, where and to the extent necessary for the performance of its tasks of assisting 
investigations of suspected child sexual abuse offences 
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The EU Centre shall provide the access referred to in paragraphs 2, 3, 4 and 5 only upon 
the reception of a request, specifying the purpose of the request, the modalities of the 
requested access, and the degree of access needed to achieve that purpose. The requests for 
the access referred to in paragraph 2 shall also include a reference to the detection order or 
the blocking order, as applicable. 


The EU Centre shall diligently assess those requests and only grant access where it 
considers that the requested access is necessary for and proportionate to the specified 


purpose. 


The EU Centre shall regularly verify that the data contained in the databases referred to in 
Articles 44 and 45 is, in all respects, complete, accurate and up-to-date and continues to be 
necessary for the purposes of reporting, detection and blocking in accordance with this 
Regulation, as well as facilitating and monitoring of accurate detection technologies and 
processes. In particular, as regards the uniform resource locators contained in the database 
referred to Article 44(1), point (a), the EU Centre shall, where necessary in cooperation 
with the Coordination Authorities, regularly verify that the conditions of Article 36(1), 
point (b), continue to be met. Those verifications shall include audits, where appropriate. 
Where necessary in view of those verifications, it shall immediately complement, adjust or 
delete the data. 


The EU Centre shall ensure that the data contained in the databases referred to in Articles 
44 and 45 is stored in a secure manner and that the storage is subject to appropriate 
technical and organisational safeguards. Those safeguards shall ensure, in particular, that 
the data can be accessed and processed only by duly authorised persons for the purpose for 
which the person is authorised and that a high level of security is achieved. The EU Centre 
shall regularly review those safeguards and adjust them where necessary. 


Article 47 


Delegated acts relating to the databases 


The Commission shall be empowered to adopt delegated acts in accordance with Article 86 in order 
to supplement this Regulation with the necessary detailed rules concerning: 


(a) 


(b) 


(c) 


(d) 


the types, precise content, set-up and operation of the databases of indicators referred to in 
Article 44(1), including the indicators and the necessary additional information to be 
contained therein referred to in Article 44(2); 


the processing of the submissions by Coordinating Authorities, the generation of the 
indicators, the compilation of the list of uniform resource locators and the record-keeping, 
referred to in Article 44(3); 


the precise content, set-up and operation of the database of reports referred to in Article 
45(1); 


access to the databases referred to in Articles 44 and 45, including the modalities of the 
access referred to in Article 46(1) to (5), the content, processing and assessment of the 
requests referred to in Article 46(6), procedural matters related to such requests and the 
necessary measures referred to in Article 46(6); 
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(c) 


the regular verifications and audits to ensure that the data contained in those databases is 
complete, accurate and up-to-date referred to in Article 46(7) and the security of the 
storage of the data, including the technical and organisational safeguards and regular 
review referred to in Article 46(8). 


Article 48 
Reporting 


The EU Centre shall expeditiously assess and process reports submitted by providers of 
hosting services and providers of interpersonal communications services in accordance 
with Article 12 to determine whether the reports are manifestly unfounded or are to be 
forwarded. 


Where the EU Centre considers that the report is manifestly unfounded, it shall inform the 
provider that submitted the report, specifying the reasons why it considers the report to be 
unfounded. 


Where the EU Centre considers that a report is not manifestly unfounded, it shall forward 
the report, together with any additional relevant information available to it, to Europol and 
to the competent law enforcement authority or authorities of the Member State likely to 
have jurisdiction to investigate or prosecute the potential child sexual abuse to which the 
report relates. 


Where that competent law enforcement authority or those competent law enforcement 
authorities cannot be determined with sufficient certainty, the EU Centre shall forward the 
report, together with any additional relevant information available to it, to Europol, for 
further analysis and subsequent referral by Europol to the competent law enforcement 
authority or authorities. 


37 


37 


COM proposal: Aim is to make even more clear the expedite processing in the EU Centre for 
these urgent reports. It keeps the review (expedited) to serve as a safeguard against possible 
misuse by the providers (to avoid having to complete the reports, which would not be helpful 
for law enforcement, and it would “pollute” the system and harm the situations that do require 
real urgent action). Text as follows: “The EU Centre shall perform the assessment and 
processing referred to in paragraphs 1, 2 and 3 of this Article as a matter of priority in respect 
of reports submitted in accordance with Article 13(2), first subparagraph. In particular, where 
the EU Centre considers that such a report is not manifestly unfounded and that there is likely 
to be an imminent threat to the life or safety of a child, it shall immediately forward the report 
in accordance with paragraph 3, marking it as requiring urgent action. Where the EU Centre 
considers, in respect of a report submitted in accordance with Article 13(2), first 
subparagraph, that there is not likely to be an imminent threat to the life of a child, it shall 
indicate that when forwarding the report in accordance with paragraph 3 and it shall also 
inform the provider that submitted the report and the competent authority, specifying in all 
cases the reasons why it considers that there is not likely to be an imminent threat to the life of 
a child.” 
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Where a provider that submitted the report has indicated that the report requires urgent 
action, the EU Centre shall assess and process that report as a matter of priority and, where 
it forwards the report in accordance with paragraph 3 and it considers that the report 
requires urgent action, shall ensure that the forwarded report is marked as such. 


Where the report does not contain all the information required in Article 13, the EU Centre 
may request the provider that submitted the report to provide the missing information. 


Where so requested by a competent law enforcement authority of a Member State in order 
to avoid interfering with activities for the prevention, detection, investigation and 
prosecution of child sexual abuse offences, the EU Centre shall: 


(a) communicate to the provider that submitted the report that it is not to inform the user 
concerned, specifying the time period during which the provider is not to do so; 


(b) where the provider that submitted the report is a provider of hosting services and the 
report concerns the potential dissemination of child sexual abuse material, 
communicate to the provider that it is not to remove or disable access to the material, 
specifying the time period during which the provider is not to do so. 


The time periods referred to in the first subparagraph, points (a) and (b), shall be those 
specified in the competent law enforcement authority’s request to the EU Centre, provided 
that they remain limited to what is necessary to avoid interference with the relevant 
activities and does not exceed 18 months. 


The EU Centre shall verify whether a provider of hosting services that submitted a report 
concerning the potential dissemination of child sexual abuse material removed or disabled 
access to the material, insofar as the material is publicly accessible. Where it considers that 
the provider did not remove or disable access to the material expeditiously, the EU Centre 
shall inform the Coordinating Authority of establishment thereof. 


Article 49 
Searches and notification 


The EU Centre shall have the power to conduct searches on hosting services for the 
dissemination of publicly accessible child sexual abuse material, using the relevant 
indicators from the database of indicators referred to in Article 44(1), points (a) and (b), in 
the following situations: 


(a) where so requested to support a victim by verifying whether the provider of hosting 
services removed or disabled access to one or more specific items of known child 
sexual abuse material depicting the victim, in accordance with Article 21(4), point 
(c); 

(b) where so requested to assist a Coordinatine—Authorty competent authority by 
verifying the possible need for the issuance of a-detection-orderor a removal order in 
respect of a specific service etthe-effectiveness_ofadetection _orderoratremovat 


order that the-Coordinatine Authority issued, in accordance with Article 25(7), points 
(c) and-(d)-respeetively; 
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c where so requested to assist a Coordinating Authority, by verifying the 


effectiveness of a detection order that the competent judicial authorities or other 
independent administrative authorities issued, in accordance with Article 25(7), 
point (d). 


oe The EU Centre shall have the power to notify, after having conducted the searches referred 
to in paragraph 1, providers of hosting services of the presence of one or more specific 
items of known child sexual abuse material on their services and request them to remove or 
disable access to that item or those items, for the providers’ voluntary consideration. 


The request shall clearly set out the identification details of the EU Centre and a contact 
point, the necessary information for the identification of the item or items, as well as the 
reasons for the request. The request shall also clearly state that it is for the provider’s 
voluntary consideration. 


2 Where so requested by a competent law enforcement authority of a Member State in order 
to avoid interfering with activities for the prevention, detection, investigation and 
prosecution of child sexual abuse offences, the EU Centre shall not submit a notice, for as 
long as necessary to avoid such interference but no longer than 18 months. 


Article 50 
Technologies, information and expertise 


1. The EU Centre shall make available technologies that providers of hosting services and 
providers of interpersonal communications services may acquire, install and operate, free 
of charge, where relevant subject to reasonable licensing conditions, to execute detection 
orders in accordance with Article 10(1). 


To that aim, the EU Centre shall compile lists of such technologies, having regard to the 
requirements of this Regulation and in particular those of Article 10(2). 


Before including specific technologies on those lists, the EU Centre shall request the 
opinion of its Technology Committee and of the European Data Protection Board. The 
Technology Committee and the European Data Protection Board shall deliver their 
respective opinions within eight weeks. That period may be extended by a further six 
weeks where necessary, taking into account the complexity of the subject matter. The 
Technology Committee and the European Data Protection Board shall inform the EU 
Centre of any such extension within one month of receipt of the request for consultation, 
together with the reasons for the delay. 


D.. The EU Centre shall collect, record, analyse and make available relevant, objective, 
reliable and comparable information on matters related to the prevention and combating of 
child sexual abuse, in particular: 


(a) information obtained in the performance of its tasks under this Regulation 
concerning detection, reporting, removal or disabling of access to, and blocking of 
online child sexual abuse; 
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(6) — information-+resultine from the research_surveys-and studies referred to in-_paragraph 
3; 


(c) information resulting from research or other activities conducted by Member States’ 
authorities, other Union institutions, bodies, offices and agencies, the competent 
authorities of third countries, international organisations, research centres and civil 
society organisations. 


Where necessary for the performance of its tasks under this Regulation, the EU Centre 
shall carry out, participate in or encourage research, surveys and studies, either on its own 
initiative or, where appropriate and compatible with its priorities and its annual work 
programme, at the request of the European Parliament, the Council or the Commission. 


The EU Centre shall provide the information referred to in paragraph 2 and the information 
resulting from the research, surveys and studies referred to in paragraph 3, including its 
analysis thereof, and its opinions on matters related to the prevention and combating of 
online child sexual abuse to other Union institutions, bodies, offices and agencies, 
Coordinating Authorities, other competent authorities and other public authorities of the 
Member States, either on its own initiative or at request of the relevant authority. Where 
appropriate, the EU Centre shall make such information publicly available. 


The EU Centre shall develop a communication strategy and promote dialogue with civil 
society organisations and providers of hosting or interpersonal communication services to 
raise public awareness of online child sexual abuse and measures to prevent and combat 
such abuse. 
Section 3 
Processing of information 
Article 51 


Processing activities and data protection 


In so far as is necessary for the performance of its tasks under this Regulation, the EU 
Centre may process personal data. 


The EU Centre shall process personal data as strictly necessary for the purposes of: 
(a) providing the opinions on intended detection orders referred to in Article 7(3); 


(b) cooperating with and responding to requests of Coordinating Authorities in 
connection to intended blocking orders as referred to in Article 16(2); 


(c) receiving and processing blocking orders transmitted to it pursuant to Article 17(3); 
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(d) 


(c) 


(f) 


(g) 
(h) 


(i) 
Gj) 
(k) 


(I) 
(m) 


(n) 


(0) 


cooperating with Coordinating Authorities in accordance with Articles 20 and 21 on 
tasks related to victims’ rights to information and assistance; 


maintaining up-to-date records of contact points and legal representatives of 
providers of relevant information society services as provided in accordance with 
Article 23(2) and Article 24(6); 


creating and maintaining an online register listing the Coordinating Authorities and 
their contact points referred to in Article 25(6); 


providing assistance to Coordinating Authorities in accordance with Article 25(7); 


assisting the Commission, upon its request, in connection to its tasks under the 
cooperation mechanism referred to in Article 37; 


create, maintain and operate the databases of indicators referred to in Article 44; 
create, maintain and operate the database of reports referred to in Article 45; 


providing and monitoring access to the databases of indicators and of reports in 
accordance with Article 46; 


performing data quality control measures in accordance with Article 46(7); 


assessing and processing reports of potential online child sexual abuse in accordance 
with Article 48; 


cooperating with Europol and partner organisations in accordance with Articles 53 
and 54, including on tasks related to the identification of victims; 


generating statistics in accordance with Article 83. 


The EU Centre shall store the personal data referred to in paragraph 2 only where and for 
as long as strictly necessary for the applicable purposes listed in paragraph 2. 


It shall ensure that the personal data is stored in a secure manner and that the storage is 
subject to appropriate technical and organisational safeguards. Those safeguards shall 
ensure, in particular, that the personal data can be accessed and processed only for the 
purpose for which it is stored, that a high level of security is achieved and that the personal 
data is deleted when no longer strictly necessary for the applicable purposes. It shall 
regularly review those safeguards and adjust them where necessary. 
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Section 4 
Cooperation 
Article 52 
Contact officers 


Each Coordinating Authority shall designate at least one contact officer, who shall be the 
main contact point for the EU Centre in the Member State concerned. The contact officers 
may be seconded to the EU Centre. Where several contact officers are designated, the 
Coordinating Authority shall designate one of them as the main contact officer. 


Contact officers shall assist in the exchange of information between the EU Centre and the 
Coordinating Authorities that designated them. Where the EU Centre receives reports 
submitted in accordance with Article 12 concerning the potential dissemination of new 
child sexual abuse material or the potential solicitation of children, the contact officers 
designated by the competent Member State shall facilitate the process to determine the 
illegality of the material or conversation, in accordance with Article 36(1). 


The Management Board shall determine the rights and obligations of contact officers in 
relation to the EU Centre. Contact officers shall enjoy the privileges and immunities 
necessary for the performance of their tasks. 


Where contact officers are seconded to the EU Centre, the EU Centre shall cover the costs 
of providing them with the necessary premises within the building and adequate support 
for contact officers to perform their duties. All other costs that arise in connection with the 
designation of contact officers and the performance of their tasks shall be borne by the 
Coordinating Authority that designated them. 


Article 53 
Cooperation with Europol 


Where necessary for the performance of its tasks under this Regulation, within their 
respective mandates, the EU Centre shall cooperate with Europol. 


Europol and the EU Centre shall provide each other with the fullest possible access to 
relevant information and information systems, where necessary for the performance of 
their respective tasks and in accordance with the acts of Union law regulating such access. 


Without prejudice to the responsibilities of the Executive Director, the EU Centre shall 
maximise efficiency by sharing administrative functions with Europol, including functions 
relating to personnel management, information technology (IT) and budget 
implementation. 


The terms of cooperation and working arrangements shall be laid down in a memorandum 
of understanding. 
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Article 54 
Cooperation with partner organisations 


1. Where necessary for the performance of its tasks under this Regulation, the EU Centre may 
cooperate with organisations and networks with information and expertise on matters 
related to the prevention and combating of online child sexual abuse, including civil 
society organisations and semi-public organisations. 


2. The EU Centre may conclude memoranda of understanding with organisations referred to 
in paragraph 1, laying down the terms of cooperation. 


Section 5 
Organisation 
Article 55 
Administrative and management structure 
The administrative and management structure of the EU Centre shall comprise: 
(a) a Management Board, which shall exercise the functions set out in Article 57; 
(b) an Executive Board which shall perform the tasks set out in Article 62; 


(c) an Executive Director of the EU Centre, who shall exercise the responsibilities set 
out in Article 64; 


(d) a Technology Committee as an advisory group, which shall exercise the tasks set out 
in Article 66. 


Part 1: Management Board 


Article 56 
Composition of the Management Board 


1. The Management Board shall be composed of one representative from each Member State 
and two representatives of the Commission, all as members with voting rights. 


2 The Management Board shall also include one independent expert observer designated by 
the European Parliament, without the right to vote. 


Europol may designate a representative to attend the meetings of the Management Board 
as an observer on matters involving Europol, at the request of the Chairperson of the 
Management Board. 
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2D: Each member of the Management Board shall have an alternate. The alternate shall 
represent the member in his/her absence. 


4. Members of the Management Board and their alternates shall be appointed in the light of 
their knowledge in the field of combating child sexual abuse, taking into account relevant 
managerial, administrative and budgetary skills. Member States shall appoint a 
representative of their Coordinating Authority, within four months of [date of entry into 
force of this Regulation]. All parties represented in the Management Board shall make 
efforts to limit turnover of their representatives, in order to ensure continuity of its work. 
All parties shall aim to achieve a balanced representation between men and women on the 
Management Board. 


3: The term of office for members and their alternates shall be four years. That term may be 
renewed. 


Article 57 
Functions of the Management Board 
1. The Management Board shall: 
(a) give the general orientations for the EU Centre's activities; 


(b) contribute to facilitate the effective cooperation with and between the Coordinating 
Authorities; 


(c) adopt rules for the prevention and management of conflicts of interest in respect of 
its members, as well as for the members of the Technological Committee and of any 
other advisory group it may establish and publish annually on its website the 
declaration of interests of the members of the Management Board; 


(d) adopt the assessment of performance of the Executive Board referred to in Article 
61(2); 


(e) adopt and make public its Rules of Procedure; 


(f) appoint the members of the Technology Committee, and of any other advisory group 
it may establish; 


(g) adopt the opinions on intended detection orders referred to in Article 7(4), on the 
basis of a draft opinion provided by the Executive Director; 


(h) adopt and regularly update the communication and dissemination plans referred to in 
Article 77(3) based on an analysis of needs. 
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Article 58 
Chairperson of the Management Board 


The Management Board shall elect a Chairperson and a Deputy Chairperson from among 
its members. The Chairperson and the Deputy Chairperson shall be elected by a majority 
of two thirds of the members of the Management Board. 


The Deputy Chairperson shall automatically replace the Chairperson if he/she is prevented 
from attending to his/her duties. 


The term of office of the Chairperson and the deputy Chairperson shall be four years. Their 
term of office may be renewed once. If, however, their membership of the Management 
Board ends at any time during their term of office, their term of office shall automatically 
expire on that date. 


Article 59 
Meetings of the Management Board 
The Chairperson shall convene the meetings of the Management Board. 
The Executive Director shall take part in the deliberations, without the right to vote. 


The Management Board shall hold at least two ordinary meetings a year. In addition, it 
shall meet on the initiative of its Chairperson, at the request of the Commission, or at the 
request of at least one-third of its members. 


The Management Board may invite any person whose opinion may be of interest to attend 
its meetings as an observer. 


The members of the Management Board and their alternates may, subject to its rules of 
procedure, be assisted at the meetings by advisers or experts. 


The EU Centre shall provide the secretariat for the Management Board. 
Article 60 
Voting rules of the Management Board 


Unless provided otherwise in this Regulation, the Management Board shall take decisions 
by absolute majority of its members. 


Each member shall have one vote. In the absence of a member, his/her alternate shall be 
entitled to exercise his/her right to vote. 


The Executive Director shall not take part in the voting. 
The Management Board's rules of procedure shall establish more detailed voting 


arrangements, in particular the circumstances in which a member may act on behalf of 
another member. 
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Part 2: Executive Board 


Article 61 
Composition and appointment of the Executive Board 


The Executive Board shall be composed of the Chairperson and the Deputy Chairperson of 
the Management Board, two other members appointed by the Management Board from 
among its members with the right to vote and two representatives of the Commission to the 
Management Board. The Chairperson of the Management Board shall also be the 
Chairperson of the Executive Board. 


The Executive Director shall participate in meetings of the Executive Board without the 
right to vote. 


The term of office of members of the Executive Board shall be four years. In the course of 
the 12 months preceding the end of the four-year term of office of the Chairperson and five 
members of the Executive Board, the Management Board or a smaller committee selected 
among Management Board members including a Commission representative shall carry 
out an assessment of performance of the Executive Board. The assessment shall take into 
account an evaluation of the Executive Board members’ performance and the EU Centre’s 
future tasks and challenges. Based on the assessment, the Management Board may extend 
their term of office once. 


Article 62 
Tasks of the Executive Board 


The Executive Board shall be responsible for the overall planning and the execution of the 
tasks conferred on the EU Centre pursuant to Article 43. The Executive Board shall adopt 
all the decisions of the EU Centre with the exception of the decisions that shall be taken by 
the Management Board in accordance with Article 57. 


In addition, the Executive Board shall have the following tasks: 


(a) adopt, by 30 November of each year, on the basis of a proposal by the Executive 
Director, the draft Single Programming Document, and shall transmit it for 
information to the European Parliament, the Council and the Commission by 31 
January the following year, as well as any other updated version of the document; 


(b) adopt the draft annual budget of the EU Centre and exercise other functions in 
respect of the EU Centre’s budget; 


(c) assess and adopt a consolidated annual activity report on the EU Centre's activities, 
including an overview of the fulfilment of its tasks and send it, by | July each year, 
to the European Parliament, the Council, the Commission and the Court of Auditors 
and make the consolidated annual activity report public; 
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(d) 


(c) 


(f) 
(g) 


(h) 


(i) 


(j) 


(k) 


(I) 

(m) 
(n) 
(0) 


(p) 


adopt an anti-fraud strategy, proportionate to fraud risks taking into account the costs 
and benefits of the measures to be implemented, an efficiency gains and synergies 
strategy, a strategy for cooperation with third countries and/or international 
organisations, and a strategy for the organisational management and internal control 
systems 


adopt rules for the prevention and management of conflicts of interest in respect of 
its members; 


adopt its rules of procedure; 


exercise, with respect to the staff of the EU Centre, the powers conferred by the Staff 
Regulations on the Appointing Authority and by the Conditions of Employment of 
Other Servants on the EU Centre Empowered to Conclude a Contract of 
Employment’ ("the appointing authority powers"); 


adopt appropriate implementing rules for giving effect to the Staff Regulations and 
the Conditions of Employment of Other Servants in accordance with Article 110(2) 
of the Staff Regulations; 


appoint the Executive Director and remove him/her from office, in accordance with 
Article 65; 


appoint an Accounting Officer, who may be the Commission's Accounting Officer, 
subject to the Staff Regulations and the Conditions of Employment of other servants, 
who shall be totally independent in the performance of his/her duties; 


ensure adequate follow-up to findings and recommendations stemming from the 
internal or external audit reports and evaluations, as well as from investigations of 
the European Anti-Fraud Office (OLAF); 


adopt the financial rules applicable to the EU Centre; 


take all decisions on the establishment of the EU Centre's internal structures and, 
where necessary, their modification. 


appoint a Data Protection Officer; 
adopt internal guidelines further specifying the procedures for the processing of 
information in accordance with Article 51, after consulting the European Data 


Protection Supervisor; 


authorise the conclusion of memoranda of understanding referred to in Article 53(3) 
and Article 54(2). 


38 Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying 
down the Staff Regulations of Officials and the Conditions of Employment of Other Servants 
of the European Communities and instituting special measures temporarily applicable to 
officials of the Commission (OJ L 56, 4.3.1968, p. 1) 
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With respect to the powers mentioned in paragraph 2 point (g) and (h), the Executive 
Board shall adopt, in accordance with Article 110(2) of the Staff Regulations, a decision 
based on Article 2(1) of the Staff Regulations and Article 6 of the Conditions of 
Employment, delegating relevant appointing authority powers to the Executive Director. 
The Executive Director shall be authorised to sub-delegate those powers. 


In exceptional circumstances, the Executive Board may by way of a decision temporarily 
suspend the delegation of the appointing authority powers to the Executive Director and 
any sub-delegation by the latter and exercise them itself or delegate them to one of its 
members or to a staff member other than the Executive Director. 


Where necessary because of urgency, the Executive Board may take certain provisional 
decisions on behalf of the Management Board, in particular on administrative management 
matters, including the suspension of the delegation of the appointing authority powers and 
budgetary matters. 


Article 63 
Voting rules of the Executive Board 


The Executive Board shall take decisions by simple majority of its members. Each member 
of the Executive Board shall have one vote. The Chairperson shall have a casting vote in 
case of a tie. 


The representatives of the Commission shall have a right to vote whenever matters 
pertaining to Article 62(2), points (a) to (1) and (p) are discussed and decided upon. For the 
purposes of taking the decisions referred to in Article 62(2), points (f) and (g), the 
representatives of the Commission shall have one vote each. The decisions referred to in 
Article 62(2), points (b) to (e), (h) to (1) and (p), may only be taken if the representatives of 
the Commission casts a positive vote. For the purposes of taking the decisions referred to 
in Article 62(2), point (a), the consent of the representatives of the Commission shall only 
be required on the elements of the decision not related to the annual and multi-annual 
working programme of the EU Centre. 


The Executive Board's rules of procedure shall establish more detailed voting 
arrangements, in particular the circumstances in which a member may act on behalf of 
another member. 
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Part 3: Executive Director 


Article 64 
Responsibilities of the Executive Director 


1. The Executive Director shall manage the EU Centre. The Executive Director shall be 
accountable to the Management Board. 


2. The Executive Director shall report to the European Parliament on the performance of 
his/her duties when invited to do so. The Council may invite the Executive Director to 
report on the performance of his/her duties. 


3. The Executive Director shall be the legal representative of the EU Centre. 

4. The Executive Director shall be responsible for the implementation of the tasks assigned to 
the EU Centre by this Regulation. In particular, the Executive Director shall be responsible 
for: 


(a) the day-to-day administration of the EU Centre; 
(b) preparing decisions to be adopted by the Management Board; 
(c) implementing decisions adopted by the Management Board; 


(d) preparing the Single Programming Document and submitting it to the Executive 
Board after consulting the Commission; 


(e) implementing the Single Programming Document and reporting to the Executive 
Board on its implementation; 


(f) preparing the Consolidated Annual Activity Report (CAAR) on the EU Centre’s 
activities and presenting it to the Executive Board for assessment and adoption; 


(g) preparing an action plan following-up conclusions of internal or external audit 
reports and evaluations, as well as investigations by the European Anti-Fraud Office 
(OLAF) and by the European Public Prosecutor’s Office (EPPO) and reporting on 
progress twice a year to the Commission and regularly to the Management Board and 
the Executive Board; 


(h) protecting the financial interests of the Union by applying preventive measures 
against fraud, corruption and any other illegal activities, without prejudicing the 
investigative competence of OLAF and EPPO by effective checks and, if 
irregularities are detected, by recovering amounts wrongly paid and, where 
appropriate, by imposing effective, proportionate and dissuasive administrative, 
including financial penalties; 
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(i) preparing an anti-fraud strategy, an efficiency gains and synergies strategy, a strategy 
for cooperation with third countries and/or international organisations and a strategy 
for the organisational management and internal control systems for the EU Centre 
and presenting them to the Executive Board for approval; 


(j) preparing draft financial rules applicable to the EU Centre; 


(k) preparing the EU Centre’s draft statement of estimates of revenue and expenditure 
and implementing its budget; 


(1) preparing and implementing an IT security strategy, ensuring appropriate risk 
management for all IT infrastructure, systems and services, which are developed or 
procured by the EU Centre as well as sufficient IT security funding, 


(m) implementing the annual work programme of the EU Centre under the control of the 
Executive Board; 


(n) drawing up a draft statement of estimates of the EU Centre’s revenue and 
expenditure as part of the EU Centre’s Single Programming Document and 
implementing the budget of the EU Centre pursuant to Article 67; 


(0) preparing a draft report describing all activities of the EU Centre with a section on 
financial and administrative matters; 


(p) fostering recruitment of appropriately skilled and experienced EU Centre staff, while 
ensuring gender balance. 


a: Where exceptional circumstances so require, the Executive Director may decide to locate 
one or more staff in another Member State for the purpose of carrying out the EU Centre’s 
tasks in an a more efficient, effective and coherent manner. Before deciding to establish a 
local office, the Executive Director shall obtain the prior consent of the Commission, the 
Management Board and the Member State concerned. The decision shall be based on an 
appropriate cost-benefit analysis that demonstrates in particular the added value of such 
decision and specify the scope of the activities to be carried out at the local office in a 
manner that avoids unnecessary costs and duplication of administrative functions of the EU 
Centre. A headquarters agreement with the Member State(s) concerned may be concluded. 


Article 65 
Executive Director 


s The Executive Director shall be engaged as a temporary agent of the EU Centre under 
Article 2(a) of the Conditions of Employment of Other Servants. 


2. The Executive Director shall be appointed by the Executive Board, from a list of 
candidates proposed by the Commission, following an open and transparent selection 
procedure. 
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B For the purpose of concluding the contract with the Executive Director, the EU Centre 
shall be represented by the Chairperson of the Executive Board. 


4. The term of office of the Executive Director shall be five years. Six months before the end 
of the Executive Director’s term of office, the Commission shall complete an assessment 
that takes into account an evaluation of the Executive Director's performance and the EU 
Centre's future tasks and challenges. 


5. The Executive Board, acting on a proposal from the Commission that takes into account 
the assessment referred to in paragraph 3, may extend the term of office of the Executive 
Director once, for no more than five years. 


6. An Executive Director whose term of office has been extended may not participate in 
another selection procedure for the same post at the end of the overall period. 


Ts The Executive Director may be dismissed only upon a decision of the Executive Board 
acting on a proposal from the Commission. 


8. The Executive Board shall take decisions on appointment, extension of the term of office 
or dismissal of the Executive Director by a majority of two-thirds of its members with 
voting rights. 


Subsection 5: Technology Committee 
Article 66 
Establishment and tasks of the Technology Committee 


1. The Technology Committee shall consist of technical experts appointed by the 
Management Board in view of their excellence and their independence, following the 
publication of a call for expressions of interest in the Official Journal of the European 


Union. 

2 Procedures concerning the appointment of the members of the Technology Committee and 
its operation shall be specified in the rules of procedure of the Management Board and 
shall be made public. 

ee The members of the Committee shall be independent and shall act in the public interest. 


The list of members of the Committee shall be made public and shall be updated by the EU 
Centre on its website. 


4. When a member no longer meets the criteria of independence, he or she shall inform the 
Management Board. Alternatively, the Management Board may declare, on a proposal of 
at least one third of its members or of the Commission, a lack of independence and revoke 
the person concerned. The Management Board shall appoint a new member for the 
remaining term of office in accordance with the procedure for ordinary members. 
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by The mandates of members of the Technology Committee shall be four years. Those 
mandates shall be renewable once. 


6. The Technology Committee shall 


(a) contribute to the EU Centre’s opinions referred to in Article 7(3), first subparagraph, 
point (d); 


(b) contribute to the EU Centre’s assistance to the Coordinating Authorities, the 
Management Board, the Executive Board and the Executive Director, in respect of 
matters related to the use of technology; 


(c) provide internally, upon request, expertise on matters related to the use of technology 
for the purposes of prevention and detection of child sexual abuse online. 


Article 66a 


Appointment and tasks of the Victims and Survivors Board 


1. The Victims and Survivors Board shall be comprised. of adult victims and survivors of 


child sexual abuse who, following a call for expressions of interest published in the 
Official Journal of the European Union, will be appointed by the Management Board on 
the basis of their personal experience, expertise and independence. 


2. The procedures governing the appointment of the members of the Victims and Survivors 
Board, its functioning and the conditions governing the transmission of information to 
the Victims and Survivors Board shall be laid down in the Management Board’s Rules of 
Procedure, and shall be published. 


3. The members of the Victims and Survivors Board shall be independent and shall act in 
the interest of persons affected by online child sexual abuse. The EU Centre shall publish 


on its website and keep up to date the list of the members of the Victims and Survivors 
Board. 


4, Members who cease to be independent shall inform the Management Board accordingly. 
Otherwise, the Management Board, at the proposal of at least one third of its members or 
of the Commission, may determine that they lack sufficient independence and revoke 
their appointment. The Management Board shall appoint new members to replace them 
for the remainder of their predecessors’ term of office, following the same procedure as 
the one governing ordinary members. 


5. The term of office of members of the Victims and Survivors Board shall be four years. It 
may be renewed once. 


6. The Executive Director and the Management Board may consult the Victims and 


Survivors Board in connection with all matters concerning persons affected by online 
child sexual abuse. 
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7. The Victims and Survivors Board has the following tasks: 


(a) make the concerns of survivors visible; 


(b) advise the Management Board in matters referred to in Article 57 (1), sentence 2; 


(c) advise the Executive Director and the Management Board as _ foreseen in 
paragraph 6; 


(d) incorporate their experience and expertise as regards preventing and combating 
online child sexual abuse, assisting and supporting survivors 


(e) contribute own proposals for the work of the competent authorities Ceerdinating 


Authorities: 
(f) contribute to the European networking of victims and_ survivors of child sexual 
abuse. 
Section 6 
Establishment and Structure of the Budget 
Subsection 1 
Single Programming Document 
Article 67 
Budget establishment and implementation 
1. Each year the Executive Director shall draw up a draft statement of estimates of the EU 


Centre’s revenue and expenditure for the following financial year, including an 
establishment plan, and shall send it to the Executive Board. 


2: The Executive Board shall, on the basis of the draft statement of estimates, adopt a 
provisional draft estimate of the EU Centre’s revenue and expenditure for the following 
financial year and shall send it to the Commission by 31 January each year. 


5a The Executive Board shall send the final draft estimate of the EU Centre’s revenue and 
expenditure, which shall include a draft establishment plan, to the European Parliament, 
the Council and the Commission by 31 March each year. 


4, The Commission shall send the statement of estimates to the European Parliament and the 
Council, together with the draft general budget of the Union. 
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a: On the basis of the statement of estimates, the Commission shall enter in the draft general 
budget of the Union the estimates that it considers necessary for the establishment plan and 
the amount of the contribution to be charged to the general budget, which it shall place 
before the European Parliament and the Council in accordance with Articles 313 and 314 
of the Treaty on the Functioning of the European Union. 


6. The European Parliament and the Council shall authorise the appropriations for the 
contribution from the Union to the EU Centre. 


re The European Parliament and the Council shall adopt the EU Centre’s establishment plan. 


8. The EU Centre’s budget shall be adopted by the Executive Board. It shall become final 
following the final adoption of the general budget of the Union. Where necessary, it shall 
be adjusted accordingly. 


9. The Executive Director shall implement the EU Centre’s budget. 


10. Each year the Executive Director shall send to the European Parliament and the Council all 
information relevant to the findings of any evaluation procedures. 


Article 68 
Financial rules 


The financial rules applicable to the EU Centre shall be adopted by the Executive Board after 
consultation with the Commission. They shall not depart from Delegated Regulation (EU) 
2019/715*° unless such a departure is specifically required for the operation of the EU Centre and 
the Commission has given its prior consent. 


Subsection 2 
Presentation, implementation and control of the budget 
Article 69 
Budget 
1. Estimates of all revenue and expenditure for the EU Centre shall be prepared each financial 
year, which shall correspond to the calendar year, and shall be shown in the EU Centre’s 


budget, which shall be balanced in terms of revenue and of expenditure. 


ag Without prejudice to other resources, the EU Centre’s revenue shall comprise a 
contribution from the Union entered in the general budget of the Union. 


39 OJ L 122, 10.5.2019, p. 1. 
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a: The EU Centre may benefit from Union funding in the form of delegation agreements or 
ad hoc grants in accordance with its financial rules referred to in Article 68 and with the 
provisions of the relevant instruments supporting the policies of the Union. 


4. The EU Centre’s expenditure shall include staff remuneration, administrative and 
infrastructure expenses, and operating costs. 


ai Budgetary commitments for actions relating to large-scale projects extending over more 
than one financial year may be broken down into several annual instalments. 


Article 70 
Presentation of accounts and discharge 
1. The EU Centre’s accounting officer shall send the provisional accounts for the financial 


year (year N) to the Commission's accounting officer and to the Court of Auditors by 1 
March of the following financial year (year N + 1). 


2. The EU Centre shall send a report on the budgetary and financial management for year N 
to the European Parliament, the Council and the Court of Auditors by 31 March of year N 
san 

3; The Commission's accounting officer shall send the EU Centre’s provisional accounts for 


year N, consolidated with the Commission's accounts, to the Court of Auditors by 31 
March of year N + 1. 


4. The Management Board shall deliver an opinion on the EU Centre’s final accounts for year 
N. 
a The EU Centre’s accounting officer shall, by 1 July of year N + 1, send the final accounts 


for year N to the European Parliament, the Council, the Commission, the Court of Auditors 
and national parliaments, together with the Management Board's opinion. 


6. The final accounts for year N shall be published in the Official Journal of the European 
Union by 15 November of year N + 1. 


2 The Executive Director shall send to the Court of Auditors, by 30 September of year N + 1, 
a reply to the observations made in its annual report. He or she shall also send the reply to 
the Management Board. 


8. The Executive Director shall submit to the European Parliament, at the latter's request, any 
information required for the smooth application of the discharge procedure for year N. 


% On a recommendation from the Council acting by a qualified majority, the European 
Parliament shall, before 15 May of year N + 2, grant a discharge to the Executive Director 
in respect of the implementation of the budget for year N. 
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Protocol 


Section 7 
Staff 
Article 71 
General provisions 


The Staff Regulations and the Conditions of Employment of Other Servants and the rules 
adopted by agreement between the institutions of the Union for giving effect thereto shall 
apply to the EU Centre for all matters not covered by this Regulation. 


The Executive Board, in agreement with the Commission, shall adopt the necessary 
implementing measures, in accordance with the arrangements provided for in Article 110 
of the Staff Regulations. 


The EU Centre staff, in particular those working in areas related to detection, reporting and 
removal of online child sexual abuse, shall have access to appropriate counselling and 
support services. 


Article 72 
Seconded national experts and other staff 


The EU Centre may make use of seconded national experts or other staff not employed by 
it. 


The Executive Board shall adopt rules related to staff from Member States, including the 
contact officers referred to in Article 52, to be seconded to the EU Centre and update them 
as necessary. Those rules shall include, in particular, the financial arrangements related to 
those secondments, including insurance and training. Those rules shall take into account 
the fact that the staff is seconded and to be deployed as staff of the EU Centre. They shall 
include provisions on the conditions of deployment. Where relevant, the Executive Board 
shall aim to ensure consistency with the rules applicable to retmbursement of the mission 
expenses of the statutory staff. 


Article 73 
Privileges and immunities 


No 7 on the Privileges and Immunities of the European Union annexed to the Treaty on the 


Functioning of the European Union shall apply to the EU Centre and its staff. 


Privileges and immunities of contact officers and members of their families shall be subject to an 
agreement between the Member State where the seat of the EU Centre is located and the other 


Member 


States. That agreement shall provide for such privileges and immunities as are necessary 


for the proper performance of the tasks of contact officers. 
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40 


41 


Article 74 
Obligation of professional secrecy 


Members of the Management Board and the Executive Board, and all members of the staff 
of the EU Centre, including officials seconded by Member States on a temporary basis, and 
all other persons carrying out tasks for the EU Centre on a contractual basis, shall be 
subject to the requirements of professional secrecy pursuant to Article 339 of the Treaty on 
the Functioning of the European Union even after their duties have ceased. 


The Executive Board shall ensure that individuals who provide any service, directly or 
indirectly, permanently or occasionally, relating to the tasks of the EU Centre, including 
officials and other persons authorised by the Executive Board or appointed by the 
coordinating authorities for that purpose, are subject to requirements of professional 
secrecy equivalent to those in paragraph 1. 


The EU Centre shall establish practical arrangements for implementing the confidentiality 
rules referred to in paragraphs | and 2. 


The EU Centre shall apply Commission Decision (EU, Euratom) 2015/444, 
Article 75 
Security rules on the protection of classified and sensitive non-classified information 


The EU Centre shall adopt its own security rules equivalent to the Commission’s security 
rules for protecting European Union Classified Information (EUCI) and sensitive non- 
classified information, as set out in Commission Decisions (EU, Euratom) 2015/4434! and 
(EU, Euratom) 2015/444. The security rules of the EU Centre shall cover, inter alia, 
provisions for the exchange, processing and storage of such information. The Executive 
Board shall adopt the EU Centre’s security rules following approval by the Commission. 


Any administrative arrangement on the exchange of classified information with the 
relevant authorities of a third country or, in the absence of such arrangement, any 
exceptional ad-hoc release of EUCI to those authorities, shall be subject to the 
Commission’s prior approval. 


Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for 
protecting EU classified information (OJ L 72, 17.3.2015, p. 53). 

Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the 
Commission (OJ L 72, 17.3.2015, p. 41). 
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Section 8 
General provisions 
Article 76 
Language arrangements 


The provisions laid down in Regulation No 1* shall apply to the EU Centre. The translation 
services required for the functioning of the EU Centre shall be provided by the Translation Centre 
for the bodies of the European Union. 


Article 77 
Transparency and communication 


1. Regulation (EC) No 1049/2001* shall apply to documents held by the EU Centre. The 
Management Board shall, within six months of the date of its first meeting, adopt the 
detailed rules for applying that Regulation. 


2. The processing of personal data by the EU Centre shall be subject to Regulation (EU) 
2018/1725. The Management Board shall, within six months of the date of its first 
meeting, establish measures for the application of that Regulation by the EU Centre, 
including those concerning the appointment of a Data Protection Officer of the EU Centre. 
Those measures shall be established after consultation of the European Data Protection 
Supervisor. 


3. The EU Centre may engage in communication activities on its own initiative within its 
field of competence. Communication activities shall be carried out in accordance with 
relevant communication and dissemination plans adopted by the Management Board. 


Article 78 
Anti-fraud measures 


1. In order to combat fraud, corruption and other unlawful activities, Regulation (EU, 
Euratom) No 883/2013* shall apply. 


42 Regulation No | determining the languages to be used by the European Economic 


Community (OJ 17, 6.10.1958, p. 385/58). 

43 Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 
2001 regarding public access to European Parliament, Council and Commission documents, 
Official Journal L 145 , 31/05/2001 P. 0043 — 0048. 

44 Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 
September 2013 concerning investigations conducted by the European Anti-Fraud Office 
(OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the 
Council and Council Regulation (Euratom) No 1074/1999. (OJ L 248, 18.9.2013, p. 1). 
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De The EU Centre shall accede to the Interinstitutional Agreement of 25 May 1999 between 
the European Parliament, the Council of the European Union and the Commission of the 
European Communities concerning internal investigations by OLAF within six months 
from [date of start of operations as set out in Article 82] and shall adopt the appropriate 
provisions applicable to its staff using the template set out in the Annex to that Agreement. 


3, The European Court of Auditors shall have the power of audit, on the basis of documents 
and on the spot, over all grant beneficiaries, contractors and subcontractors who have 
received Union funds from the EU Centre. 


4. OLAF may carry out investigations, including on-the-spot checks and inspections with a 
view to establishing whether there has been fraud, corruption or any other illegal activity 
affecting the financial interests of the Union in connection with a grant or a contract 
funded by the EU Centre, in accordance with the provisions and procedures laid down in 
Regulation (EU, Euratom) No 883/2013 and Council Regulation (Euratom, EC) No 
2185/96*. 


5, Without prejudice to paragraphs 1, 2, 3, and 4, cooperation agreements with third countries 
and international organisations, contracts, grant agreements and grant decisions of the EU 
Centre shall contain provisions expressly empowering the European Court of Auditors and 
OLAF to conduct such audits and investigations, in accordance with their respective 


competences. 
Article 79 
Liability 
1. The EU Centre's contractual liability shall be governed by the law applicable to the 
contract in question. 
2: The Court of Justice of the European Union shall have jurisdiction to give judgment 


pursuant to any arbitration clause contained in a contract concluded by the EU Centre. 


a: In the case of non-contractual liability, the EU Centre shall, in accordance with the general 
principles common to the laws of the Member States, make good any damage caused by its 
departments or by its staff in the performance of their duties. 


4. The Court of Justice of the European Union shall have jurisdiction in disputes over 
compensation for damages referred to in paragraph 3. 


ae The personal liability of its staff towards the Centre shall be governed by the provisions 
laid down in the Staff Regulations or Conditions of Employment applicable to them. 


45 Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-the-spot 


checks and inspections carried out by the Commission in order to protect the European 
Communities’ financial interests against fraud and other irregularities. (OJ L 292, 15.11.1996, 


p. 2). 
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Article 80 
Administrative inquiries 


The activities of the EU Centre shall be subject to the inquiries of the European Ombudsman in 
accordance with Article 228 of the Treaty on the Functioning of the European Union. 


Article 81 
Headquarters Agreement and operating conditions 


1. The necessary arrangements concerning the accommodation to be provided for the EU 
Centre in the Member State where the seat of the EU Centre is located and the facilities to 
be made available by that Member State, together with the specific rules applicable in that 
Member State to the Executive Director, members of the Executive Board, EU Centre staff 
and members of their families shall be laid down in a Headquarters Agreement between the 
EU Centre and the Member State where the seat of the EU Centre is located, concluded 
after obtaining the approval of the Executive Board and no later than /2 years after the 
entry into force of this Regulation]. 


2; The Member State where the seat of the EU Centre is located shall provide the best 
possible conditions to ensure the smooth and efficient functioning of the EU Centre, 
including multilingual, European-oriented schooling and appropriate transport connections. 


Article 82 
Start of the EU Centre's activities 


1. The Commission shall be responsible for the establishment and initial operation of the EU 
Centre until the Executive Director has taken up his or her duties following his or her 
appointment by the Executive Board in accordance with Article 65(2). For that purpose: 


(a) the Commission may designate a Commission official to act as interim Executive 
Director and exercise the duties assigned to the Executive Director; 


(b) by derogation from Article 62(2)(g) and until the adoption of a decision as referred to 
in Article 62(4), the interim Executive Director shall exercise the appointing 
authority power; 


(c) the Commission may offer assistance to the EU Centre, in particular by seconding 
Commission officials to carry out the activities of the EU Centre under the 
responsibility of the interim Executive Director or the Executive Director; 


(d) the interim Executive Director may authorise all payments covered by appropriations 
entered in the EU Centre's budget after approval by the Executive Board and may 
conclude contracts, including staff contracts, following the adoption of the EU 
Centre's establishment plan. 
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CHAPTER V 


DATA COLLECTION AND TRANSPARENCY REPORTING 
Article 83 
Data collection 


1. Providers of relevant information society services that were ee to orders under 
Articles 7, 14, 14a, 16 and 18a 
communications_services, _providers_of internet_aceess_services shall collect data on the 
following topics and make that information available to the EU Centre upon request: 


(a) where the provider has been subject to a detection order issued in accordance with 
Article 7: 


_ the measures taken to comply with the order, including the technologies used 
for that purpose and the safeguards provided; 


- the error rates of the technologies deployed to detect online child sexual abuse 
and measures taken to prevent or remedy any errors; 


— in relation to complaints and cases submitted by users in connection to the 
measures taken to comply with the order, the number of complaints submitted 
directly to the provider, the number of cases brought before a judicial authority, 
the basis for those complaints and cases, the decisions taken in respect of those 
complaints and in those cases, the average time needed for taking those 
decisions and the number of instances where those decisions were subsequently 
reversed; 


(b) the number of removal orders and cross-border removal orders issued to the 


provider in accordance with Articles 14 and 14a—the—-average—time—neededfor 
Fees ot se tine eee to the tent ot ten of ehild sex dat abuse taterky tt 


question; 


(c) the total number of items of child sexual abuse material that the provider removed or 
to which it disabled access, broken down by whether the items were removed or 
access thereto was disabled pursuant to a removal order, cross-border removal 
order or to a notice submitted by a Competent Authority, the EU Centre or a third 
party or at the provider’s own initiative; 


(d) the number of blocking orders issued to the provider in accordance with Article 16; 


(da) the number of delisting orders issued to the provider in accordance with Article 
18a; 
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(e) the number of instances in which the provider invoked Article 8(3), Article 14(5) or 
(6), et Article 17(4a) or (5) or Article 18b(4) or (5), together with the reasons 
grounds therefor; 


pm The Coordinating Authorities eempetent-authorities shall collect data on the following 
topics and make that information available to the EU Centre upon request: 


eae Re eee ey am XS 


outeome otha actor and the teases tote 


— where-no-action- was taken, the reasons for not taking any action: 


(b) the most important and recurrent risks of online child sexual abuse, as reported by 
providers of hosting services and providers of interpersonal communications services 
in accordance with Article 53 or identified through other information available te+he 


S soedlinal see 


(c) a list of the providers of hosting services and providers of interpersonal 
communications services to which the Coordinating Authority addressed a detection 
order in accordance with Article 7; 


46 PCY comment: The PCY concludes that many delegations have objections to this provision, 


at least as regards the level of detail. The PCY also observes that it would be a major 
undertaking to ensure that a report is flagged as it is processed or being an element of a 
process in a way that ensures a feedback loop whenever a measure is taken in connection with 
the processing. The PCY would like to hear if delegations see prospects for a simplified 
reporting requirement concerning the follow-up of reports or if such reporting should 
be part of future developments. 
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(d) the number of detection orders issued in accordance with Article 7, broken down by 
provider and by type of online child sexual abuse, and the number of instances in 
which the provider invoked Article 8(3); 


(e) a list of providers of hosting services to which the-Ceordinatine Authertyissued a 


removal order or cross-border removal order were issued in accordance with 
Articles 14 and 14a; 


(f) the number of removal orders pened in aecoramice i oo 14, ag down @ 
provider, the A b 
sexualabusematerial soneored: ad the dumber of Tstanees in whicy a crv 
invoked Article 14(5) and (6); 


(g) the number of blocking orders issued in accordance with Article 16, broken down by 
provider, and the number of instances in which the provider invoked Article 17(4a) 
or (5); 


G) {he—jnsianices—tn_which_the-opinion—of the “EC —Centre—pursnan_to—Article TCD) 
ubstantia -deviated from the opinion-o natine Authorits ecifvine 


(ga) the number of complaints received in accordance with Article 34 broken down 
by what the alleged infringement of this Regulation was concerned with and 


he wabasteeed laint, 


3: The EU Centre shall collect data and generate statistics on the detection, reporting, 
removal of or disabling of access to online child sexual abuse under this Regulation. The 
data shall be in particular on the following topics:*” 


(a) the number of indicators in the databases of indicators referred to in Article 44 and 
the development of that number as compared to previous years; 


(b) the number of submissions of child sexual abuse material and solicitation of children 
referred to in Article 36(1), broken down by Member State that designated the 
submitting Coordinating Authorities, and, in the case of child sexual abuse material, 
the number of indicators generated on the basis thereof and the number of uniform 
resource locators included in the list of uniform resource locators in accordance with 
Article 44(3); 


47 PCY comment: It seems to the PCY that several items in paragraph 3 can only be properly 


assessed and discussed once increased clarity on the outcome of their respective basis is 
reached. 
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(c) 


(d) 


(c) 


(f) 


(g) 


(h) 


(j) 


the total number of reports submitted to the EU Centre in accordance with Article 12, 
broken down by provider of hosting services and provider of interpersonal 
communications services that submitted the report and by Member State the 
competent authority of which the EU Centre forwarded the reports to in accordance 
with Article 48(3); 


the enlne-chid sexual abusetowhich the reports _relate_inchidine the-number of 


items of potential known and new child sexual abuse material and instances of 
potential solicitation of children included in the reports the-—Member—State—the 
competent authority-of which the EU Centre forwarded the-reperts te in accordance 
with Article 48(3), and type of relevant information society service that the reporting 
provider offers; 


the number of reports that the EU Centre considered manifestly unfounded, as 
referred to in Article 48(2); 


the number of reports relating to potential new child sexual abuse material and 
solicitation of children that were assessed as not constituting child sexual abuse 
material of which the EU Centre was informed pursuant to Article 36(3), broken 
down by Member State; 


the results of the searches in accordance with Article 49(1), including the number of 
images, videos and URLs by Member State where the material is hosted; 


where the same item of potential child sexual abuse material was reported more than 
once to the EU Centre in accordance with Article 12 or detected more than once 
through the searches in accordance with Article 49(1), the number of times that that 
item was reported or detected in that manner. 


the number of notices and number of providers of hosting services notified by the EU 
Centre pursuant to Article 49(2); 


number of victims of online child sexual abuse assisted by the EU Centre pursuant to 
Article 21(2), and the number of these victims that requested to receive such 
assistance in a manner accessible to them due to disabilities. 


Providers of relevant information society services that were subject to orders under 


Articles 7, 14, 14a, 16 and 18a —The_providers—of hosting services, _providers—of 


interpersonal _communications_services—and_providers—_of_internet_aceess—_services, the 
Coordinating Authorities [or other competent authorities] and the EU Centre shall 


ensure that the data referred to in paragraphs 1, 2 and 3, respectively, is stored no longer 
than is necessary for the transparency reporting referred to in Article 84. The data stered 
referred to in paragraphs 1 to 3 shall not contain any personal data. 
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5. mepetasieieyiPei TE pC Eee Thay Sten GH Aii nin ales Duet a ALiPS 


es necessary a that purpese- They shall raheniee review ens anne ae adiust 


themprwhere-necessary: 
Article 84 
Transparency reporting 
1. Each provider of relevant information society services that were subject to orders under 


Articles 7, 14, 14a, 16 and 18a during the relevant year shall draw up an annual report 
on its activities under this Regulation. That report shall compile the information referred to 
in Article 83(1). The providers shall, by 31 January of every year subsequent to the year to 
which the report relates, make the report available to the public and communicate it to the 
Coordinating Authority of establishment, the Commission and the EU Centre. 


2 Each Coordinating Authority shall draw up an annual report on its activities under this 
Regulation. That report shall compile the information referred to in Article 83(2). It shall, 
by 31 March of every year subsequent to the year to which the report relates, make the 
report available to the public and communicate it to the Commission and the EU Centre. 


3. Where a Member State has designated several competent authorities pursuant to Article 25, 
it shall ensure that the Coordinating Authority draws up a single report covering the 
activities of all competent authorities under this Regulation and that the Coordinating 
Authority receives all relevant information and support needed to that effect from the other 
competent authorities concerned. 


4. The EU Centrewerkine in-clese-cooperation with the Coordinating Authorities, shall draw 
up an annual report on its activities under this Regulation. That report shall alse compile 


and analyse the information contained in the reports referred to in paragraphs 2 and Article 
83(3). The EU Centre shall, by 30 June of every year subsequent to the year to which the 
report relates, make the report available to the public and communicate it to the 
Commission. 


5. The annual transparency reports referred to in paragraphs 1, 2 and 3 shall not include any 
information that may prejudice ongoing activities for the assistance to victims or the 
prevention, detection, investigation or prosecution of child sexual abuse offences. They 
shall alse-not contain any personal data. 


6. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to supplement this Regulation with the necessary templates and detailed rules 
concerning the form, precise content and other details of the reports and the reporting 
process pursuant to paragraphs 1, 2 and 3. 
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CHAPTER VI 


FINAL PROVISIONS 
Article 85 
Evaluation 


1. By [five years after the entry into force of this Regulation], and every five years thereafter, 
the Commission shall evaluate this Regulation and submit a report on its application to the 
European Parliament and the Council. 


2; By [five years after the entry into force of this Regulation], and every five years thereafter, 
the Commission shall ensure that an evaluation in accordance with Commission guidelines 
of the EU Centre’s performance in relation to its objectives, mandate, tasks and 
governance and location is carried out. The evaluation shall, in particular, address the 
possible need to modify the tasks of the EU Centre, and the financial implications of any 
such modification. 


3; On the occasion of every second evaluation referred to in paragraph 2, the results achieved 
by the EU Centre shall be assessed by the Commission, having regard to its objectives and 
tasks, including an assessment of whether the continuation of the EU Centre is still 
justified with regard to those objectives and tasks. 


4. The Commission shall report to the European Parliament and the Council the findings of 
the evaluation referred to in paragraph 3. The findings of the evaluation shall be made 
public. 

yi For the purpose of carrying out the evaluations referred to in paragraphs 1, 2 and 3, the 


Coordinating Authorities and Member States and the EU Centre shall provide information 
to the Commission at its request. 


6. In carrying out the evaluations referred to in paragraphs 1, 2 and 3, the Commission shall 
take into account the relevant evidence at its disposal. 


cf Where appropriate, the reports referred to in paragraphs 1 and 4 shall be accompanied by 
legislative proposals. 
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48 


Article 86 
Exercise of the delegation 


The power to adopt delegated acts is conferred on the Commission subject to the 
conditions laid down in this Article. 


The power to adopt delegated acts referred to in Articles 3, 8, 13, 14, 17, 47 and 84 shall be 
conferred on the Commission for an indeterminate period of time from [date of adoption of 
the Regulation] *. 


The delegation of power referred to in Articles 3, 8, 13, 14, 17, 47 and 84 may be revoked 
at any time by the European Parliament or by the Council. A decision to revoke shall put 
an end to the delegation of the power specified in that decision. It shall take effect the day 
after the publication of the decision in the Official Journal of the European Union or at a 
later date specified therein. It shall not affect the validity of any delegated acts already in 
force. 


Before adopting a delegated act, the Commission shall consult experts designated by each 
Member State in accordance with the principles laid down in the Inter-institutional 
Agreement of 13 April 2016 on Better Law-Making. 


As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the 
European Parliament and to the Council. 


A delegated act adopted pursuant to Articles 3, 8, 13, 14, 17, 47 and 84 shall enter into 
force only if no objection has been expressed either by the European Parliament or the 
Council within a period of two months of notification of that act to the European 
Parliament and the Council or if, before the expiry of that period, the European Parliament 
and the Council have both informed the Commission that they will not object. That period 
shall be extended by two months at the initiative of the European Parliament or of the 
Council. 


PCY comment: The PCY has taken note of the comment from some delegations that the 


delegation in relation to Article 47 is concerned with subject-matters that may not be 
appropriate for such delegation due to its principal nature. The PCY suggests that this 
particular issue is discussed in connection with Article 47 and, where needed, in connection 
with the other Articles referred to here. 
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Article 87 
Committee procedure 


1. For the purposes of the adoption of the implementing acts referred to in Article 39(4), the 
Commission shall be assisted by a committee. That committee shall be a committee within 
the meaning of Regulation (EU) No 182/2011. 


2: Where reference is made to this paragraph, Article 4 of Regulation (EU) No 182/2011 shall 
apply. 
Article 88” 
Repeal 


Regulation (EU) 2021/1232 is repealed from [date of application of this Regulation]. 
Article 89 


Entry into force and application 


This Regulation shall enter into force on the twentieth day following that of its publication in the 
Official Journal of the European Union. 


It shall apply from 18 6months after its entry into force. 


This Regulation shall be binding in its entirety and directly applicable in all Member States. 


Done at Brussels, 


For the European Parliament For the Council 


The President The President 


49 PCY comment: Many delegations are in favour of exploring how the Temporary Regulation 


could be prolonged and/or how to allow voluntary detection on a permanent basis by 
including the provisions of the Temporary Regulation in this Regulation. 
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ANNEX 


Article 27 [clean version of former Art 27-30] 
Investigatory and enforcement powers 


1. Where needed in order to carrying out their tasks under this Regulation, competent 
authorities shall have the following powers of investigation, in respect of conduct by 
providers of relevant information society services falling within the competence of their 
Member State: 


(a) the power to require those providers, as well as any other persons acting for purposes 
related to their trade, business, craft or profession that may reasonably be aware of 
information relating to a suspected infringement of this Regulation, to provide such 
information without undue delay; 


(b) the power to carry out, or to request a judicial authority to order, inspections of any 
premises that those providers or those persons use for purposes related to their trade, 
business, craft or profession, or to request other public authorities to do so, in order 
to examine, seize, take or obtain copies of information relating to a suspected 
infringement in any form, irrespective of the storage medium; 


(c) the power to ask any member of staff or representative of those providers or those 
persons to give explanations in respect of any information relating to a suspected 
infringement and to record the answers by any technical means; 


(d) the power to request information, including to assess whether the measures taken to 
execute a detection order, removal order, blocking order or delisting order comply 
with the requirements of this Regulation. 


De Where needed for carrying out their tasks under this Regulation, competent authorities 
shall have the following enforcement powers, in respect of providers of relevant 
information society services falling within the competence of their Member State: 


(a) the power to accept the commitments offered by those providers in relation to their 
compliance with this Regulation and to make those commitments binding; 


(b) | the power to order the cessation of infringements and, where appropriate, to impose 
remedies proportionate to the infringement and necessary to bring the infringement 
effectively to an end or to request a judicial authority to do so; 


(c) the power to impose fines, or request a judicial authority in their Member State to do 
so, in accordance with Article 35 for failure to comply with this Regulation, 
including any of the investigative orders issued pursuant to paragraph 1 of this 
Article; 
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(d) the power to impose a periodic penalty payment, or to request a judicial authority to 
do so, in accordance with Article 35 to ensure that an infringement is terminated in 
compliance with an order issued pursuant to point (b) of this subparagraph or for 
failure to comply with any of the orders issued pursuant to paragraph 1 of this 
Article. 


(e) the power to adopt interim measures or to request the competent national judicial 
authority to do so, to avoid the risk of serious harm. 


As regards the first subparagraph, points (c) and (d), competent authorities shall also have 
the enforcement powers set out in those points in respect of the other persons referred to in 
paragraph 1, for failure to comply with any of the orders issued to them pursuant to that 
paragraph. They shall only exercise those enforcement powers after having provided those 
other persons in good time with all relevant information relating to such orders, including 
the applicable period, the fines or periodic payments that may be imposed for failure to 
comply and the possibilities for redress. 


3; Where needed for carrying out their tasks under this Regulation, competent authorities 
shall, in respect of providers of relevant information society services falling within the 
competence of their Member State, where all other powers pursuant to this Article to bring 
about the cessation of an infringement have been exhausted and the infringement has not 
been remedied or is continuing and is eausing serious harm which cannot be avoided 
through the exercise of other powers available under Union or national law, also have the 
power to take the following measures: 


(a) to require the management body of the providers, without undue delay, to examine 
the situation, to adopt and submit an action plan setting out the necessary measures to 
terminate the infringement, to ensure that the provider takes those measures, and to 
report on the measures taken; 


(b) where the competent authorities, including the Coordinating Authorities consider that 
a provider of relevant information society services has not sufficiently complied with 
the requirements of point (a), that the infringement has not been remedied or is 
continuing and is causing serious harm, and that that infringement entails a criminal 
offence involving a threat to the life or safety of persons or the infringement results 
in the regular and structural facilitation of child sexual abuse offences, to request that 
the competent judicial authority or other independent administrative authority of its 
Member State order the temporary restriction of access of users of the service 
concerned by the infringement or, only where that is not technically feasible, to the 
online interface of the provider on which the infringement takes place. 


The competent authorities, including the Coordinating Authorities, shall, prior to 
submitting the request referred to in this paragraph, point (b), invite interested parties to 
submit written observations within a period that shall not be less than two weeks, 
describing the measures that it intends to request and identifying the intended addressee or 
addressees thereof. The provider, the intended addressee or addressees and any other third 
party demonstrating a legitimate interest shall be entitled to participate in the proceedings 
before the competent judicial authority or other independent administrative authority. 
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Any measure ordered shall be proportionate to the nature, gravity, recurrence and duration 
of the infringement, without unduly restricting access to lawful information by users of the 
service concerned. 


The restriction of access shall be for a period of four weeks, subject to the possibility for 
the competent judicial authority or other independent administrative authority of the 
Member State, in its order, to allow the competent authorities, including the Coordinating 
Authorities, to extend that period for further periods of the same lengths, subject to a 
maximum number of extensions set by a that judicial authority or other independent 
administrative authority. 


The competent authorities, including the Coordinating Authorities, referred to in the 
previous subparagraph shall only extend the period where, having regard. to the rights and 
interests of all parties affected by that restriction and all relevant circumstances, including 
any information that the provider, the addressee or addressees and any other third party 
that demonstrated a legitimate interest may provide to it, it considers that both of the 
following conditions have been met: 


(a) the provider has failed to take the necessary measures to terminate the infringement; 


(b) the temporary restriction does not unduly restrict access to lawful information by 
users of the service, having regard to the number of users affected and whether any 
adequate and readily accessible alternatives exist. 


Where the competent authority, including the Coordinating Authority, considers that the 
conditions set out in the fourth subparagraph, points (a) and (b) have been met but it cannot 
further extend the period pursuant to the fourth subparagraph, it shall submit a new request 
to the competent judicial authority or other independent administrative authority, as 
referred to in the first subparagraph, point (b). 


4. The measures taken by the competent authorities, including the Coordinating Authorities, 
in the exercise of their powers listed in paragraphs 1, 2 and 3 shall be effective, dissuasive 
and proportionate, having regard, in particular, to the nature, gravity, recurrence and 
duration of the infringement or suspected infringement to which those measures relate, as 
well as the economic, technical and operational capacity of the provider of relevant 
information society services concerned; where relevant. 


as Member States shall lay down specific rules and procedures for the exercise of the powers 
pursuant to paragraphs 1, 2 and 3 and shall ensure that any exercise of those powers is 
subject to adequate safeguards laid down in the applicable national law in compliance with 
the Charter and with the general principles of Union law. In particular, those measures 
shall only be taken in accordance with the right to respect for private life and the rights of 
defence, including the rights to be heard and of access to the file, and subject to the right to 
an effective judicial remedy of all affected parties. 
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